Vulnerable Components in Feathersjs with Hmac Signatures

FeathersJS is a framework for real-time web applications that can expose REST and socket endpoints. When Hmac Signatures are used for authentication, the security of the implementation depends on how the signature is generated, transmitted, and verified. A common vulnerability pattern is to sign only a subset of the request components, such as the payload or selected headers, while omitting others that an attacker can manipulate. For example, if the signature is computed over the JSON body but the HTTP method, URL path, or selected headers are not included, an attacker can change the method from POST to GET or switch the target endpoint, and the server may still accept the request if only the body signature is validated.

Another specific risk in FeathersJS applications is the misuse of a static or predictable secret key combined with a nonce or timestamp that is not properly enforced on every verification. If the server only checks that a signature exists and does not validate that the timestamp is within a tight window or that the nonce has not been reused, an attacker can replay a captured request. FeathersJS hooks that modify the request parameters before authentication runs can inadvertently strip or alter signature-related headers, causing the verification logic to operate on incomplete or modified data.

Configuration issues in the service middleware can also introduce vulnerabilities. For instance, if the Hmac Signature authentication hook is applied only to certain routes or conditionally skipped based on the presence of other authentication strategies, an attacker might route requests through unauthenticated paths. Additionally, failing to enforce signature verification on both the client and server for all sensitive operations means that some endpoints remain unsigned, providing an avenue to tamper with data or elevate privileges.

Real-world attack patterns include tampering with the method or url components of the signed string, injecting additional headers that are ignored during verification, or exploiting differences in how whitespace and encoding are handled between the client and server implementations. Because FeathersJS allows custom hooks and transports, inconsistent implementation across services can lead to partial coverage where only some routes are protected. An attacker who identifies an unsigned or weakly signed endpoint may attempt injection, IDOR, or privilege escalation, especially if the endpoint exposes sensitive data or modifies state.

To assess this combination using middleBrick, you can run a scan against the unauthenticated API surface. The tool checks for missing integrity on critical components such as method, host, port, and path within the signed string, and flags endpoints that accept requests without valid Hmac Signatures. Findings are mapped to relevant frameworks and standards, providing prioritized remediation guidance without requiring credentials or internal architecture details.

To securely implement Hmac Signatures in FeathersJS, include a consistent set of components in the signed string: the HTTP method, the full path (including query parameters), selected headers, and the request body. Use a constant-time comparison for the computed and received signatures to prevent timing attacks. Below is a server-side example that computes the signature over these components and attaches it to an x-api-signature header.

const crypto = require('crypto');

function computeHmacSignature(secret, method, url, headers, body) {
  const sortedKeys = Object.keys(headers).sort();
  const headerString = sortedKeys.map(k => `${k.toLowerCase()}:${headers[k].trim()}`).join('\n');
  const payload = [method.toUpperCase(), url, headerString, body].filter(Boolean).join('\n');
  return crypto.createHmac('sha256', secret).update(payload, 'utf8').digest('hex');
}

// In a FeathersJS before hook
app.hooks.before.push({
  name: 'verify-hmac',
  async find(context) {
    const secret = process.env.HMAC_SECRET;
    const received = context.headers['x-api-signature'];
    if (!received) {
      throw new Error('Missing signature');
    }
    const method = context.method || context.params.method || 'GET';
    const url = context.path; // e.g., /messages
    const headers = context.headers;
    // Exclude hop-by-hop headers
    const safeHeaders = Object.keys(headers).reduce((acc, key) => {
      const lower = key.toLowerCase();
      if (['host', 'content-length', 'transfer-encoding'].includes(lower)) return acc;
      acc[lower] = headers[key];
      return acc;
    }, {});
    const body = context.data ? JSON.stringify(context.data) : '';
    const expected = computeHmacSignature(secret, method, url, safeHeaders, body);
    if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received))) {
      throw new Error('Invalid signature');
    }
    return context;
  }
});

On the client side, ensure that the same components are used and that the signature header is sent with each request. Here is a client-side example that prepares the signature before sending a FeathersJS request.

const crypto = require('crypto');

function buildSignedRequest({ secret, method, url, headers, data }) {
  const sortedKeys = Object.keys(headers).sort();
  const headerString = sortedKeys.map(k => `${k.toLowerCase()}:${headers[k].trim()}`).join('\n');
  const payload = [method.toUpperCase(), url, headerString, data ? JSON.stringify(data) : ''].filter(Boolean).join('\n');
  const signature = crypto.createHmac('sha256', secret).update(payload, 'utf8').digest('hex');
  return { headers: { ...headers, 'x-api-signature': signature } };
}

// Example usage with a Feathers client
const headers = { 'content-type': 'application/json' };
const signed = buildSignedRequest({
  secret: process.env.HMAC_SECRET,
  method: 'POST',
  url: '/messages',
  headers,
  data: { text: 'Hello signed world' }
});
// Use signed.headers in your fetch or HTTP client

Additionally, incorporate a short numeric timestamp and a nonce in the signed string and validate them on the server to mitigate replay attacks. The server should reject requests with timestamps outside an acceptable window or repeated nonces. These measures, combined with consistent hook ordering and route coverage, reduce the risk of signature bypass and ensure that Hmac Signatures provide reliable integrity verification in FeathersJS applications.