Phishing Api Keys in Feathersjs with Api Keys

FeathersJS applications that rely solely on API keys for authentication can be exposed to phishing scenarios when keys are transmitted or stored insecurely. API keys are long-lived credentials; if an attacker tricks a developer or user into revealing a key (e.g., via email, chat, or fake dashboards), they can impersonate the service indefinitely until the key is rotated. In FeathersJS, this risk is amplified when keys are embedded in client-side code, logs, or error messages, because these artifacts may be exposed in repositories or browser sources. An attacker can phish keys by mimicking legitimate API endpoints or documentation, leading to unauthorized access to services that use unauthenticated or weakly protected API key validation.

During a middleBrick scan, the Authentication and Unsafe Consumption checks examine how API keys are accepted and validated. If a FeathersJS service accepts keys in query parameters or headers without additional protections, and if the service does not enforce strict referrer or origin checks, the unauthenticated attack surface increases. The scanner also tests for BFLA (Business Logic Flaws and Abuse), where key usage patterns may allow privilege escalation if keys intended for one scope are accepted by endpoints with higher privileges. Because FeathersJS often integrates with transports like REST and Socket.io, misconfigured transports can leak keys in logs or expose them via Server-Side Request Forgery (SSRF) when the service fetches remote resources using embedded credentials.

The LLM/AI Security checks performed by middleBrick are particularly relevant for phishing risks involving API keys. Active prompt injection probes test whether an attacker can coax the system into revealing key handling logic or configuration details through crafted requests. Output scanning ensures that API keys are not inadvertently returned in LLM responses or error payloads, which could aid phishing campaigns. Additionally, system prompt leakage detection helps identify patterns where key validation logic or internal instructions might be exposed, providing attackers with templates to craft more convincing phishing lures targeting developers who manage FeathersJS services.

To mitigate phishing risks with API keys in FeathersJS, rotate keys immediately if exposure is suspected and adopt layered defenses. Use environment variables to store keys instead of hardcoding them, and avoid passing keys via query parameters. Enforce strict transport security and validate key scopes per endpoint. The following examples demonstrate secure patterns for API key usage in FeathersJS services.

Secure configuration with environment variables

Store keys in environment variables and reference them in your FeathersJS configuration. This prevents keys from appearing in source code or logs.

// src/default.json
{
  "authentication": {
    "secret": process.env.AUTH_SECRET,
    "apiKeyHeader": process.env.API_KEY_HEADER || 'X-API-Key'
  },
  "hooks": {
    "before": {
      "all": ["@feathersjs/authentication-hooks"]
    }
  }
}

Custom hook to validate API keys securely

Implement a hook that validates keys against a stored set of allowed values without exposing them in responses or logs.

// src/hooks/validate-api-key.js
module.exports = function apiKeyValidationHook(options = {}) {
  return async context => {
    const { apiKeyHeader = 'X-API-Key' } = context.app.get('authentication');
    const providedKey = context.headers[apiKeyHeader];
    const validKeys = context.app.get('validApiKeys'); // e.g., Set from env

    if (!providedKey || !validKeys.has(providedKey)) {
      throw new Error('Not authenticated');
    }

    // Attach identity for downstream services if needed, but avoid logging the key
    context.params.provider = 'api-key';
    return context;
  };
};

Transport-specific protections

Configure REST and Socket.io transports to restrict key exposure. For REST, avoid echoing keys in URLs; for Socket.io, use middleware to validate before allowing events.

// src/transport-configuration.js
const feathers = require('@feathersjs/feathers');
const rest = require('@feathersjs/express');
const socketio = require('@feathersjs/socketio');

const app = feathers();
app.configure(rest());
app.configure(socketio({
  cors: {
    origin: process.env.ALLOWED_ORIGIN,
    credentials: true
  },
  allowRequest: (req, callback) => {
    const valid = validateSocketKey(req);
    callback(null, valid);
  }
}));

function validateSocketKey(req) {
  const key = req.headers['x-api-key'];
  return key && process.env.VALID_SOCKET_KEYS.split(',').includes(key);
}

Integration with middleBrick

Use the middleBrick CLI to validate your FeathersJS configuration and detect insecure key handling. Scan from terminal with middlebrick scan <url> to identify authentication weaknesses and BFLA risks. For continuous assurance, the Pro plan enables scheduled scans and integrates with GitHub Actions to fail builds if risk scores degrade. The MCP Server allows you to run scans directly from IDEs like Cursor or Claude, embedding security checks into development workflows.