Use After Free in Adonisjs with Basic Auth

Use After Free (UAF) occurs when memory is deallocated but references to it remain, and later reuse of that memory leads to corruption or information disclosure. In AdonisJS, this risk can surface in request-handling pipelines when objects tied to an authenticated session are destroyed while a reference is still held for later use. When Basic Authentication is used, the framework parses credentials on each request, creates temporary objects (such as user identity payloads or token holders), and may cache or pass references into downstream middleware or route handlers. If these references are retained beyond the request lifecycle—by closures, event emitters, or improperly scoped services—freed objects can be inadvertently accessed, exposing runtime state or allowing an attacker to influence behavior.

With Basic Auth, credentials are sent on every request and typically validated via a lightweight provider or guard. AdonisJS guards often hydrate a User model and attach it to the auth context. If the application or a third-party package holds onto that context after the request ends (for example, storing it in a global map or reusing a service instance), the underlying memory can be freed while the reference remains. Subsequent requests may then observe stale data or trigger unpredictable behavior, potentially leaking information from the freed memory or enabling privilege confusion across users. This becomes more likely when sessions are managed implicitly and developers assume object lifetimes align strictly with request boundaries. Because Basic Auth does not inherently tie authentication to a long-lived session store, it can mask these timing issues, making UAF harder to detect without active scanning focused on object lifecycle and reference handling.

In practice, an attacker might probe endpoints protected by Basic Auth while monitoring responses for anomalies that hint at memory reuse—such as inconsistent user data across requests or unexpected validation states. Because middleBrick tests the unauthenticated attack surface, it flags endpoints where authentication headers are accepted but object lifetimes are not properly constrained, highlighting where UAF could manifest. The risk is not in the authentication scheme itself, but in how AdonisJS applications manage references to authenticated context beyond the scope of a single request. Proper scoping, avoiding global retention of request-bound objects, and ensuring middleware does not cache user instances mitigates this class of flaw.

To mitigate Use After Free in AdonisJS with Basic Auth, ensure authenticated objects are not retained beyond the request lifecycle and that no middleware or service holds stale references. Use AdonisJS auth providers and guards as intended, and avoid attaching user instances to global or long-lived objects. The following examples demonstrate secure patterns.

Secure Basic Auth setup with scoped authentication

Use the built-in Basic Auth provider so credentials are validated per-request and the user object is not cached improperly.

// start/config/auth.ts
import { defineConfig } from '@ioc:Adonisjs/Auth'

export default defineConfig({
  guards: {
    basic: {
      driver: 'basic',
      provider: {
        driver: 'lucid',
        model: () => import('#models/user'),
      },
    },
  },
})

In your route or controller, authenticate per request and avoid storing the user reference globally.

// controllers/AuthController.ts
import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'
import { schema } from '@ioc:Adonis/Core/Validator'

export default class AuthController {
  public async login({ request, auth, response }: HttpContextContract) {
    const body = request.validate({
      schema: schema.create({
        username: schema.string(),
        password: schema.string(),
      }),
    })

    // This performs Basic Auth validation scoped to the request
    if (await auth.use('basic').attempt(body.username, body.password)) {
      const user = auth.user
      // Use user within the request scope only
      return response.ok({ message: 'Authenticated', userId: user.id })
    }

    return response.unauthorized()
  }
}

Middleware that avoids reference retention

Ensure middleware does not cache auth.user or attach it to external structures.

// middleware/ensureUserScope.ts
import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

export default function ensureUserScope() {
  return async (ctx: HttpContextContract, next: () => Promise) => {
    // Perform checks using ctx.auth.user within the request only
    if (ctx.auth.user) {
      // Do NOT store ctx.auth.user in globals, closures, or long-lived caches
      await next()
      return
    }

    ctx.response.status(401).send('Unauthorized')
  }
}

Cleanup patterns in event listeners

If using events, do not capture the auth context in a way that prolongs its lifetime beyond the request.

// listeners/UserLoggedInListener.ts
import User from 'App/Models/User'

export default class UserLoggedInListener {
  public handle(user: User) {
    // Process event without retaining user beyond handler execution
    // Avoid assigning user to static fields or external maps
    console.log('User logged in:', user.id)
  }
}