Password Spraying in Express with Cockroachdb

Password spraying is an authentication attack where an adversary uses a small number of common passwords against many accounts, aiming to avoid account lockouts triggered by single-user brute-force attempts. When Express routes interact with Cockroachdb, the risk arises from a combination of application-level authentication logic and database-side behavior, particularly around timing, query structure, and error handling.

Consider an Express endpoint that accepts a user identifier (e.g., email or username) and queries Cockroachdb to verify credentials. If the endpoint responds with different timing or distinct error messages depending on whether the account exists, an attacker can enumerate valid users. For example, a query such as SELECT * FROM users WHERE email = $1 will complete faster when the row exists, compared to when it does not, enabling user discovery through timing differences. Even if the application uses a constant-time comparison for passwords, the database lookup phase can leak information. In Cockroachdb, the execution plan for a point lookup on a primary key is typically fast, but a full table scan for a non-indexed column can be slower, further amplifying timing discrepancies.

Additionally, if the Express application does not enforce rate limiting or account lockout at the API layer, an attacker can perform thousands of password attempts across many accounts without triggering defenses. Cockroachdb’s strong consistency and transaction semantics do not inherently protect against this; in fact, its predictable commit and replication behavior can make timing measurements more reliable for an attacker. Common errors include logging detailed database errors to the client, which reveals whether a query matched a row, and failing to parameterize queries properly, which can lead to injection that aids enumeration. The OWASP API Top 10 category for Broken Object Level Authorization (BOLA) often intersects with authentication weaknesses like password spraying, especially when identifiers are exposed or inferred.

Real-world attack patterns also involve credential reuse across services. If an Express app uses the same password hashing parameters as other systems, compromised hashes from elsewhere can be used in spraying campaigns. In a CI/CD workflow monitored by the middleBrick GitHub Action, such misconfigurations can be flagged before deployment. middleBrick’s scans include checks for authentication weaknesses and BOLA/IDOR risks, helping teams detect unsafe authentication designs early. Without continuous monitoring, subtle timing and enumeration issues in the Express-to-Cockroachdb path can persist through releases.

Compliance frameworks like PCI-DSS and SOC2 require protections against brute-force and credential stuffing. middleBrick’s findings map to these controls and provide prioritized remediation guidance. For teams using the middleBrick CLI (middlebrick scan <url>) or integrating scans into scripts, automated detection of authentication anomalies accelerates remediation. The key is to treat authentication as a system-level property, not just a database query problem.

To mitigate password spraying when using Express and Cockroachdb, implement layered defenses that remove timing and enumeration leaks, enforce rate limits, and handle errors uniformly. Below are concrete, realistic code examples that address the database and application layers together.

1. Use a constant-time authentication flow

Ensure that the flow for existing and non-existing users takes approximately the same time. One approach is to always run a key-stretching operation (e.g., bcrypt) for a fixed duration, even when the user is not found. This prevents timing differences that reveal account existence.

const bcrypt = require('bcrypt');
const { Pool } = require('pg');

const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
});

async function authenticateUser(email, passwordAttempt) {
  const userResult = await pool.query(
    'SELECT id, password_hash FROM users WHERE email = $1',
    [email]
  );
  const user = userResult.rows[0];

  // Use a fixed dummy hash to keep timing consistent
  const dummyHash = await bcrypt.hash('dummy', 10);
  const hashToUse = user ? user.password_hash : dummyHash;

  const match = await bcrypt.compare(passwordAttempt, hashToUse);
  return match ? user : null;
}

2. Parameterized queries and error handling

Always use parameterized SQL to prevent injection and ensure stable execution paths. Avoid exposing database-specific errors to the client.

app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  try {
    const result = await pool.query(
      'SELECT id, password_hash FROM users WHERE email = $1',
      [email]
    );
    const user = result.rows[0];
    if (!user) {
      // Do not reveal user existence; use a dummy hash
      await bcrypt.compare(password, await bcrypt.hash('dummy', 10));
      return res.status(401).json({ error: 'Invalid credentials' });
    }
    const valid = await bcrypt.compare(password, user.password_hash);
    if (!valid) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }
    res.json({ ok: true });
  } catch (err) {
    // Log full error internally, return generic message
    console.error(err);
    res.status(500).json({ error: 'Authentication service unavailable' });
  }
});

3. Rate limiting and account protections

Apply rate limiting at the Express layer to limit attempts per identifier and per IP. Avoid relying solely on database-side throttling.

const rateLimit = require('express-rate-limit');

const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // limit each IP to 100 requests per window
  standardHeaders: true,
  legacyHeaders: false,
});

app.use('/login', apiLimiter);

For per-account protections, maintain a lightweight store (e.g., Redis) to track failed attempts and enforce progressive delays or temporary blocks without impacting Cockroachdb directly.

4. Secure logging and operational hygiene

Never log raw passwords or detailed database errors. Use structured logging that masks sensitive data. In Cockroachdb, ensure that sensitive columns are not exposed through logs or monitoring tools. When using middleBrick’s Dashboard or CLI (middlebrick scan <url>), review authentication-related findings and adjust policies accordingly.

5. Schema and index considerations

Ensure the email column is indexed to keep lookup times predictable and avoid full scans that amplify timing differences. In Cockroachdb, primary key lookups are efficient, but secondary indexes should be maintained for query patterns used by Express routes.

-- Example DDL (Cockroachdb SQL)
CREATE TABLE users (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  email STRING UNIQUE NOT NULL,
  password_hash STRING NOT NULL,
  created_at TIMESTAMPTZ DEFAULT now()
);
CREATE INDEX idx_users_email ON users (email);