Password Spraying in Adonisjs

Password spraying attacks exploit weak authentication flows by attempting a small number of common passwords across many user accounts, avoiding account lockout mechanisms. In Adonisjs applications, this typically occurs when the framework's authentication layer does not enforce rate limiting or when custom login endpoints lack proper throttling.

In practice, an attacker might target the /login route of an Adonisjs app built with a controller that uses use Auth; and calls Auth.attempt() or Auth.login() directly. If the application uses session-based authentication without implementing express-rate-limit or similar middleware, each POST request is processed independently, allowing attackers to iterate through thousands of usernames with a short list of passwords (e.g., Password123, admin, password).

Code patterns that expose vulnerability include:

// controllers/AuthController.js
const { attempt } = use('Auth')

const login = async ({ request, response }) => {
  const { email, password } = request.all()
  try {
    const token = await attempt(email, password)
    return token
  } catch (error) {
    return response.status(401).json({ error: 'Invalid credentials' })
  }
}

Here, attempt() validates credentials against the database but does not differentiate between invalid email or incorrect password when using a generic error message. This allows attackers to programmatically test credentials across many accounts. Additionally, if the application does not implement account lockout after repeated failures or uses default session limits, password spraying becomes feasible.

Another common vector is custom password reset flows that rely on email tokens without rate limiting. Attackers can automate requests to /reset-request, testing common passwords on the new password form, especially if the API endpoint lacks exponential backoff or CAPTCHA.

Adonisjs applications using third-party packages like adonis-guard or adonis-lucid may also be vulnerable if configuration defaults are left unchanged. For example, using Auth.gate('login') without defining rate-limiting policies leaves the endpoint exposed to credential enumeration.

Importantly, password spraying is not limited to direct database checks. When Adonisjs uses JWT-based stateless authentication, attackers can script requests to /auth/refresh or /auth/logout to enumerate valid sessions, especially if token expiration is long and no throttling is applied. This expands the attack surface beyond traditional login endpoints.

Detecting password spraying in Adonisjs environments requires monitoring for anomalous authentication patterns and validating configuration defaults. middleBrick offers automated detection by scanning the unauthenticated API surface for repeated failed login attempts and weak password policies.

When scanning an Adonisjs API endpoint like /login, middleBrick analyzes response patterns for generic error messages such as { "error": "Invalid credentials" } without distinguishing between email existence or password validity. It also checks whether the endpoint lacks rate-limiting headers or delays between responses.

For example, a middleBrick scan might observe that 100 requests to /login with different usernames but the same password result in identical response structures and no HTTP 429 (Too Many Requests) status. This behavior triggers a Password Spraying finding under the Authentication category, with severity rated as high.

Additionally, middleBrick reviews Adonisjs configuration files (e.g., config/auth.js) for default settings. If expireTime for session cookies is set to a high value (e.g., 7 days) without session revocation logic, it may indicate poor session management, increasing spray risk. The scanner also checks for missing middleware in routes:

// routes/auth.js
Route.post('login', 'AuthController.login')
// Missing: .middleware(['throttle'])

middleBrick flags such configurations during static analysis of OpenAPI specs or runtime probing, linking them to OWASP API Top 10 category A07:2023 - Identification and Authentication Failures. Findings include remediation guidance and references to real-world CVEs like CVE-2022-22945, where insufficient rate limiting enabled account enumeration.

Through runtime probing and spec analysis, middleBrick identifies exposure without requiring credentials, credentials, or internal access — making it uniquely suited for black-box assessment of Adonisjs apps.

Remediating password spraying in Adonisjs requires implementing layered defenses that align with the framework's architecture and best practices. The primary mitigation strategies involve enforcing rate limiting, improving error messaging, and applying account lockout mechanisms.

First, apply rate limiting using Adonisjs's built-in throttle middleware. For example:

// routes/auth.js
Route.post('login', 'AuthController.login')
  .middleware(['throttle'])
  .where('throttle', '10/10s')

This limits login attempts to 10 per IP per 10 seconds, reducing spray feasibility. The throttle middleware can be configured to track attempts per username to prevent targeted enumeration.

Second, modify authentication logic to provide tailored responses. Instead of returning the same message for invalid email or password, distinguish between them:

// controllers/AuthController.js
const { attempt } = use('Auth')
const { response } = use('Response')

const login = async ({ request, response }) => {
  const { email, password } = request.all()
  try {
    await attempt(email, password)
    return response.json({ status: 'success' })
  } catch (error) {
    if (error.message.includes('E_USER_NOT_FOUND')) {
      return response.status(401).json({ error: 'Invalid email' })
    }
    return response.status(401).json({ error: 'Invalid password' })
  }
}

This prevents attackers from confirming the existence of user accounts, a key step in reconnaissance.

Third, implement account lockout policies using session or rate-limiting counters. For instance, track failed attempts per user and lock the account after 5 failures:

// Example using Lucid model
const User = use('App/Models/User')

const lockAccount = async (user) => {
  await User.query().update({ isLocked: true, lockedAt: new Date() })
}

Integrate this into the login flow when failed attempts exceed thresholds.

Additionally, ensure session timeouts are short and enforce multi-factor authentication (MFA) for privileged accounts. Use Adonisjs packages like adonis-otp or integrate with TOTP providers.

Finally, enable monitoring and alerting. With middleBrick Pro, set up continuous monitoring to detect spikes in failed logins and receive alerts via Slack or email. Combine this with CI/CD gates to block deployments if new vulnerabilities are introduced.