Sandbox Escape in Adonisjs with Jwt Tokens

A sandbox escape in AdonisJS when JWT tokens are used for authentication occurs when an attacker who obtains or manipulates a JWT can leverage the application’s authorization boundaries to perform actions or access data outside the intended scope. This specific combination is risky because JWTs often carry claims such as roles, scopes, or identifiers that AdonisJS may use to gate routes, policies, and models. If the application does not re-validate these claims against a trusted data source on each request, an attacker can tamper with the token (for example, by changing the role claim from user to admin) and the server may trust it without additional checks.

Consider an AdonisJS route protected by JWT middleware that relies solely on decoded token payload for authorization:

import { middleware } from '@ioc:Adonis/Addons/Auth'

Route.get('/users/:id', async ({ auth, params }) => {
  const user = await User.findOrFail(params.id)
  return user.serialize()
}).middleware(['auth:jwt'])

If the JWT contains a claim like isAdmin: true and the route handler does not verify whether the authenticated user is actually an administrator, an attacker who can modify the token (e.g., via insecure signing key exposure or algorithm confusion) can escalate privileges to admin-level actions. This becomes a sandbox escape when combined with insecure deserialization or weak signature validation, allowing an attacker to move from a low-privilege context to one where they can invoke admin-only logic or access sensitive model methods.

Another scenario involves policy enforcement that incorrectly trusts the token’s subject or roles without cross-checking the database. For instance, an endpoint that allows deleting user profiles might check a role claim in the JWT rather than confirming that the authenticated user ID matches the target profile ID:

Route.delete('/users/:id', async ({ auth, params }) => {
  const user = await auth.use('jwt').authenticate()
  if (user.role !== 'admin') {
    throw new Error('Unauthorized')
  }
  await User.findOrFail(params.id).delete()
})

If the token’s role is forged, the sandbox that should isolate user-specific operations collapses, enabling IDOR-like behavior across privilege boundaries. This is a sandbox escape because the attacker breaks out of their intended execution context by abusing trust in the token’s embedded claims. The vulnerability is compounded when the application shares namespaces or imports between authentication and authorization modules, allowing an attacker to influence authorization logic through the token.

AdonisJS does not inherently prevent these patterns; developers must enforce strict mapping between JWT identities and backend records and avoid relying on token claims for critical authorization decisions without server-side verification. Regular security scans using tools that test authentication, BOLA/IDOR, and privilege escalation checks can surface these risky trust boundaries before attackers exploit them.

Remediation focuses on ensuring JWTs are treated as untrusted input and validated against authoritative data. Always verify the token signature using a strong secret or asymmetric key, and never trust claims for authorization without cross-checking the database.

Use AdonisJS auth providers with proper jwt configuration and enforce per-request revalidation:

import { middleware } from '@ioc:Adonis/Addons/Auth'

Route.get('/users/:id', async ({ auth, params }) => {
  const jwt = auth.use('jwt')
  await jwt.verify()
  const user = await jwt.getUser()
  if (!user) {
    throw new Error('Unauthorized')
  }
  // Ensure the requesting user matches the target or has explicit admin rights from DB
  const target = await User.findOrFail(params.id)
  const requester = await User.findByOrFail('id', user.id)
  if (requester.id !== target.id && requester.role !== 'admin') {
    throw new Error('Forbidden')
  }
  return target.serialize()
}).middleware(['auth:jwt'])

Define a policy that checks ownership or explicit roles stored in your database rather than relying on JWT claims:

import { BasePolicy } from '@ioc:Adonis/Core/Policy'

Route.get('/users/:id', async ({ auth, params }) => {
  const user = await User.findOrFail(params.id)
  return user.serialize()
}).middleware(['auth:jwt', { Resource: 'users', Action: 'view' }])

// config/jwt.ts
export const jwt = {
  secret: {
    driver: 'rsa',
    publicKey: 'file:./jwt/public.key',
    privateKey: 'file:./jwt/private.key',
    passphrase: process.env.JWT_PASSPHRASE
  },
  token: {
    expiresIn: '1h'
  }
}