Time Of Check Time Of Use in Adonisjs with Basic Auth

Time Of Check Time Of Use (TOCTOU) occurs when an application checks a condition (such as authentication or authorization) and then relies on that condition when performing an action, but the state can change between the check and the use. In Adonisjs with HTTP Basic Auth, this commonly arises when authorization is evaluated in middleware or route handlers after credentials are verified, but before the target resource is accessed. An authenticated user may pass the initial check, yet the resource they are attempting to access may be modified or reassigned between the authorization decision and the actual operation, leading to privilege escalation or unauthorized data access.

Consider an endpoint that retrieves a user profile by ID. The route applies Basic Auth via an Adonisjs guard, confirming the user is authenticated. Then, a separate authorization check confirms the user can only view their own profile. However, if the profile ID is supplied by the user and the application does not revalidate ownership immediately before the database query, a TOCTOU window exists. An attacker could alter the ID between the authorization check and the query, accessing another user’s profile. This risk is compounded when the authorization logic relies on cached data or when asynchronous operations introduce gaps between checks and actions.

Adonisjs does not inherently introduce TOCTOU, but patterns common in API development can expose it. For example, using route parameters or query strings to locate resources after a successful Basic Auth check, without tying the resource ownership directly to the authenticated identity at the point of use, creates a window of vulnerability. An attacker may exploit race conditions or manipulate references to access or modify resources they should not reach. Because Basic Auth transmits credentials with each request, the authentication step is reliable, but the subsequent authorization and resource access must be tightly coupled to prevent state changes from undermining the check.

To illustrate, imagine a route that first authenticates via Basic Auth and then fetches a document by ID. If the document’s ownership is not rechecked against the authenticated user immediately before the fetch, the route may return data the user is not permitted to see. This pattern is common in services that batch operations or cache authorization results, inadvertently creating TOCTOU conditions. Even with robust Basic Auth, failing to bind resource access directly to the authenticated identity at the moment of use exposes the system to information disclosure or unintended modification.

In Adonisjs applications, mitigating TOCTOU requires designing flows where the authenticated identity is used consistently and authorization is reapplied as close as possible to the operation. Avoid relying on stale assumptions about resource ownership between checks and actions. Instead, structure queries and permissions so that the authenticated user’s identity is part of the data access logic itself, reducing the interval where state could change in an unsafe way.

Remediation for TOCTOU in Adonisjs with Basic Auth centers on ensuring that authorization is verified immediately before each sensitive operation and that resource identifiers are bound to the authenticated identity. Avoid separating authentication and authorization into distinct steps with intervening logic. Instead, integrate identity checks into the data access layer so that the user’s permissions are validated at the exact point of resource retrieval or modification.

Use Adonisjs authentication guards to verify Basic Auth credentials, then enforce ownership within the query itself. For example, rather than loading a user record and then checking roles or IDs in middleware, include the authenticated user’s identifier directly in the database query. This approach minimizes the window where state could change and ensures that access is granted only when the condition holds at execution time.

Below are concrete code examples demonstrating secure handling of Basic Auth in Adonisjs, with authorization tied tightly to the resource request.

Secure Route with Basic Auth and Immediate Ownership Check

import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'
import User from 'App/Models/User'
import Profile from 'App/Models/Profile'

export default class ProfilesController {
  public async show({ auth, params }: HttpContextContract) {
    // Basic Auth credentials are verified via the guard
    const user = await auth.use('api').authenticate()

    // Fetch the profile with an ownership condition tied to the authenticated user
    const profile = await Profile.query()
      .where('id', params.id)
      .where('user_id', user.id)
      .preload('user')
      .firstOrFail()

    return profile
  }
}

In this example, the authentication guard confirms credentials, and the query includes both the requested ID and the authenticated user’s ID. This ensures that the profile is only returned if it belongs to the authenticated user at the moment of the query, closing the TOCTOU gap.

Middleware That Avoids Decoupled Authorization

import { HttpContextContract, MiddlewareContract } from '@ioc:Adonis/Core/HttpContext'
import Profile from 'App/Models/Profile'

export default class ProfileOwnershipMiddleware implements MiddlewareContract {
  public async handle(ctx: HttpContextContract, next: () => Promise) {
    const user = ctx.auth.user
    const requestedId = ctx.request.param('id')

    // Re-validate ownership immediately before proceeding
    const exists = await Profile.query()
      .where('id', requestedId)
      .where('user_id', user?.id)
      .cache(0)
      .has()

    if (!exists) {
      ctx.response.unauthorized('Access denied: invalid or unauthorized profile ID.')
      return
    }

    await next()
  }
}

This middleware performs a fresh ownership check using the current request parameters and the authenticated user, ensuring that authorization is evaluated just before the route handler executes.

For applications using route-level binding, Adonisjs route model binding can be configured to automatically enforce ownership, further reducing the chance of TOCTOU by resolving the resource under the same identity check.

Finally, avoid caching authorization decisions across requests or operations. Treat each request as independent, and recompute permissions and resource access at the point of use, especially when Basic Auth is used, to maintain tight security boundaries.