Padding Oracle in Adonisjs with Basic Auth

A Padding Oracle attack relies on an application that leaks information about the validity of a decrypted payload through observable behavior, typically HTTP status codes or timing differences. In AdonisJS, combining Basic Authentication with encrypted data handling—such as an encrypted cookie, query parameter, or request body field—can create a scenario where padding validation errors are distinguishable to an attacker.

When a client sends a request with Basic Auth credentials, AdonisJS can authenticate the user and then proceed to decrypt a value (for example, a serialized and encrypted remember-me token or an encrypted identifier in a header). If the decryption routine uses a block cipher in a mode like CBC without proper integrity protection and returns distinct errors for invalid padding versus invalid authentication, an attacker can iteratively modify the ciphertext and observe changes in HTTP response codes or timing to infer whether the padding is correct. This becomes an oracle: the attacker uses these responses to eventually recover plaintext without needing to know the encryption key.

The risk is compounded when the encrypted payload is tied to the authenticated identity. For instance, an endpoint might decrypt a value to determine a user ID or permissions, and if padding errors result in a 500 Internal Server Error while valid padding with wrong authentication results in a 401 or 403, the difference is exploitable. Even when AdonisJS uses modern encryption utilities, developers might inadvertently expose padding-related exceptions in error responses, or rely on default exception handlers that reveal stack traces. Attackers can automate probes with modified ciphertexts and analyze status codes to perform the oracle attack, potentially recovering sensitive identifiers or tokens that enable privilege escalation or unauthorized access.

OpenAPI/Swagger analysis can surface endpoints that accept encrypted data structures while using Basic Auth, highlighting where ciphertexts are processed after authentication. Because middleBrick tests unauthenticated attack surfaces and supports OpenAPI 2.0/3.0/3.1 with full $ref resolution, it can flag endpoints where encrypted inputs are used alongside Basic Auth and where error behavior might distinguish padding failures from other errors, informing targeted manual review.

To mitigate Padding Oracle risks when using Basic Authentication in AdonisJS, ensure that decryption and authentication errors are handled uniformly and that ciphertexts are protected with integrity checks. Use authenticated encryption with associated data (AEAD) such as AES-GCM instead of raw CBC, and avoid exposing low-level padding or decryption exceptions to the client.

Below are concrete code examples for secure Basic Auth handling in AdonisJS that reduce the risk of padding or authentication oracles.

Secure Basic Auth with constant-time comparison and AEAD

Use built-in or well-audited libraries for password hashing and encryption. For encryption, prefer AES-GCM which provides confidentiality and integrity in a single step, removing padding oracle concerns entirely.

import { Encrypter } from '@ioc:AdonisJS/Addons/Encryption'
import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

export default class SessionsController {
  public async login({ request, auth, response }: HttpContextContract) {
    const { username, password } = request.only(['username', 'password'])
    const user = await User.findBy('username', username)

    if (!user || !user.verifyPassword(password)) {
      // Return a generic error and avoid timing leaks
      await new Promise((r) => setTimeout(r, 100)) // constant-time delay
      return response.unauthorized({ message: 'Invalid credentials' })
    }

    // Use encrypted, integrity-protected payloads for tokens
    const token = Encrypter.encrypt(
      { userId: user.id, scope: 'api' },
      { algorithm: 'aes-256-gcm' }
    )
    return response.cookie('token', token, { httpOnly: true, secure: true, sameSite: 'strict' }).send({ ok: true })
  }
}

Validate integrity before processing encrypted data

When you must work with ciphertexts supplied by the client (e.g., in headers or cookies), validate integrity and authenticate before using the contents. Do not decrypt with a permissive error handler that exposes padding issues.

import { Encrypter } from '@ioc:AdonisJS/Addons/Encryption'
import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

export default class TokenController {
  public async verify({ request, response }: HttpContextContract) {
    const token = request.header('x-encrypted-token')
    if (!token) {
      return response.badRequest({ message: 'Missing token' })
    }

    try {
      const payload = Encrypter.decrypt(token, { algorithm: 'aes-256-gcm' })
      // Payload is verified; safe to use
      return response.ok({ userId: payload.userId })
    } catch (error) {
      // Log the error internally, return generic failure
      console.error('Token decryption failed', error)
      return response.unauthorized({ message: 'Invalid token' })
    }
  }
}

Avoid branching on padding or decryption errors

Ensure your error handling does not differentiate between malformed ciphertext, bad padding, and authentication failures. Use a consistent response and introduce small delays to obscure timing differences where necessary.

import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

export default class SecureController {
  public async sensitive({ request, response }: HttpContextContract) {
    const cipher = request.input('data')
    if (!cipher) {
      return response.badRequest({ message: 'Missing data' })
    }

    try {
      // Decrypt and verify integrity; any error leads to same generic response
      const plaintext = decryptAndVerify(cipher)
      // process plaintext
      return response.ok({ data: plaintext })
    } catch (err) {
      // Do not distinguish padding errors from other failures
      await new Promise((r) => setTimeout(r, 50 + Math.random() * 50))
      return response.forbidden({ message: 'Invalid request' })
    }
  }
}

// Example helper that uses AEAD and throws on any failure
def function decryptAndVerify(cipher: string): any {
  // In practice, use Encrypter.decrypt with AEAD and rethrow on any issue
  throw new Error('Not implemented')
}

Additionally, prefer using the middleBrick CLI to scan endpoints that use encrypted parameters with Basic Auth. Running middlebrick scan <url> can identify risky patterns and surface them in reports, allowing you to review and remediate before deploying changes. For continuous assurance, the Pro plan enables scheduled scans and integration into CI/CD pipelines, while the MCP Server lets you trigger scans directly from your IDE when modifying authentication or encryption logic.