Security Misconfiguration in Feathersjs with Hmac Signatures

FeathersJS is a framework for building REST and real-time APIs with minimal configuration. When integrating HMAC signatures for request authentication, developers often misconfigure the verification step, leading to a security misconfiguration that weakens the entire scheme. A typical pattern is to compute an HMAC over selected parts of an incoming request, such as the HTTP method, path, selected headers, and a timestamp, then compare the computed digest with the value provided in a custom header (e.g., X-Auth-Signature).

Misconfiguration arises when the comparison is performed using a standard equality check instead of a constant-time comparison. For example, computing the HMAC on the server and then using signature === expected introduces a timing side-channel. An attacker can measure response times to progressively learn the correct signature byte by byte, effectively breaking authentication without needing the shared secret. Another common misconfiguration is including mutable or user-controlled data in the signed string without validation. If the timestamp window is too large or not enforced, an attacker can reuse a captured signature within the allowed time frame. Similarly, if the set of signed headers is not strictly limited, an attacker can inject additional headers that the server mistakenly incorporates into the computation, altering the effective signed message.

In FeathersJS, this often manifests in service hooks where authentication logic is added. If the hook computes the HMAC over a concatenation of method, url, and a timestamp but does not enforce a strict timestamp skew window, the endpoint becomes vulnerable to replay attacks. Additionally, if the server uses a weak hash (e.g., MD5 or SHA1) or does not properly encode the payload, an attacker can exploit collision weaknesses or encoding mismatches. The combination of a permissive configuration and incomplete validation amplifies the impact, allowing unauthorized access or privilege escalation.

To detect such misconfigurations, scans can inspect the hook implementations, verify that a constant-time comparison is used, confirm that signed components are strictly limited, and ensure that replay protections like tight timestamp windows and nonce tracking are in place. These checks align with the Authentication and BOLA/IDOR categories, as well as Input Validation, because malformed or unexpected inputs can bypass weak verification logic.

Remediation centers on using a constant-time comparison, strictly defining signed components, and enforcing a small timestamp skew. Below is a secure example of an authentication hook in a FeathersJS service that uses HMAC signatures with the crypto module in Node.js.

const crypto = require('crypto');

function verifyHmac(req, secret) {
  const receivedSignature = req.headers['x-auth-signature'];
  const timestamp = req.headers['x-auth-timestamp'];
  const nonce = req.headers['x-auth-nonce'];

  if (!receivedSignature || !timestamp || !nonce) {
    throw new Error('Missing authentication headers');
  }

  // Enforce a small timestamp skew window (e.g., 5 minutes)
  const now = Math.floor(Date.now() / 1000);
  const skew = 300;
  if (Math.abs(now - parseInt(timestamp, 10)) > skew) {
    throw new Error('Request expired');
  }

  // Define exactly which parts are signed
  const message = `${req.method}|${req.path}|${timestamp}|${nonce}|${JSON.stringify(req.body)}`;
  const expected = crypto.createHmac('sha256', secret)
                         .update(message)
                         .digest('hex');

  // Constant-time comparison to avoid timing attacks
  const received = Buffer.from(receivedSignature, 'hex');
  const computed = Buffer.from(expected, 'hex');
  if (received.length !== computed.length) {
    throw new Error('Invalid signature');
  }
  let result = 0;
  for (let i = 0; i < received.length; i++) {
    result |= received[i] ^ computed[i];
  }
  if (result !== 0) {
    throw new Error('Invalid signature');
  }
  return true;
}

// FeathersJS hook usage
const { authenticate } = require('@feathersjs/authentication').hooks;

module.exports = {
  before: {
    all: [authenticate('secret'), async context => {
      const secret = process.env.HMAC_SECRET;
      verifyHmac(context.request, secret);
      return context;
    }]
  },
  after: {},
  error: {}
};

This example ensures that the signature is computed over a canonical string that includes the HTTP method, path, timestamp, nonce, and the request body, preventing header injection and replay. The use of Buffer.compare or an explicit loop for constant-time comparison mitigates timing side-channels. By keeping the timestamp window tight and requiring a nonce, the implementation defends against replay and enforces freshness.

For broader coverage across your API surface, you can integrate middleBrick to scan your FeathersJS endpoints and validate that HMAC implementations avoid these misconfigurations. The CLI tool allows you to run middlebrick scan <url> from your terminal to get a security risk score and prioritized findings, while the GitHub Action can enforce a minimum score in CI/CD pipelines to catch regressions before deployment.