Exploit for Secure-auth-api

## https://sploitus.com/exploit?id=FDA11F73-F96C-54AC-A13E-1645F1AFE068
# 🔐 Secure Auth API — Built → Broken → Fixed

A hands-on security-focused Express.js API demonstrating real-world authentication and authorization vulnerabilities intentionally introduced, exploited, and then properly fixed.

This project was built to showcase practical backend security skills including JWT handling, access control, SQL injection prevention, rate limiting, and secure authorization design.

---

# 🚀 Project Overview

This API supports:

- User registration and login
- JWT-based authentication
- Protected routes
- Notes CRUD operations
- Admin-only endpoint

It includes **five intentionally introduced vulnerabilities**, each documented with:

- Root cause
- Exploitation steps
- Security impact
- Proper fix implementation

---

# 🏗 Architecture

```

secure-auth-api/
├── src/
│   ├── app.js
│   ├── db.js
│   ├── config.js
│   ├── auth/
│   │   ├── jwt.js
│   │   ├── middleware.js
│   ├── routes/
│   │   ├── auth.routes.js
│   │   ├── users.routes.js
│   │   ├── notes.routes.js
│   └── util/
│       ├── logger.js
│       ├── rateLimit.js
│
├── attacks/
│   ├── 01-idor.md
│   ├── 02-sqli.md
│   ├── 03-weak-jwt.md
│   ├── 04-missing-rate-limit.md
│   └── 05-authz-bypass.md
│
├── fixes/
│   ├── 01-idor.md
│   ├── 02-sqli.md
│   ├── 03-weak-jwt.md
│   ├── 04-rate-limit.md
│   └── 05-authz.md
│
├── docker-compose.yml
└── README.md

```

---

# 🧱 Technology Stack

- Node.js
- Express.js
- PostgreSQL
- JWT (JSON Web Tokens)
- Docker
- PowerShell test scripts

---

# ▶️ How to Run

### 1️⃣ Clone Repository

```

git clone 
cd secure-auth-api

```

### 2️⃣ Configure Environment

Create `.env`:

```

JWT_SECRET=
JWT_EXPIRES_IN=15m

```

### 3️⃣ Start with Docker

```

docker compose down -v
docker compose up --build


```

API runs at:

```

[http://localhost:3000](http://localhost:3000)

```

Login:

```

$respA = Invoke-RestMethod -Method Post -Uri "http://localhost:3000/auth/login" `
  -ContentType "application/json" `
  -Body (@{ email="a@example.com"; password="Passw0rd!" } | ConvertTo-Json)

$TOKEN_A = $respA.token


```

Health check:

```

GET /health
curl http://localhost:3000/health


```

---

# 🔐 Authentication Flow

1. `POST /auth/register`
2. `POST /auth/login`
3. Receive JWT
4. Use JWT in:

```

Authorization: Bearer 

```

Protected routes:

- `GET /me`
- `GET /notes`
- `POST /notes`
- `GET /notes/:id`
- `DELETE /notes/:id`
- `GET /admin/stats`

---

# 🎯 Vulnerabilities Demonstrated

## 1️⃣ IDOR (Insecure Direct Object Reference)

- Accessing notes by ID without verifying ownership
- Fixed by enforcing owner validation in SQL query

---

## 2️⃣ SQL Injection

- String concatenation in search query
- Exploitable via `OR 1=1`
- Fixed using parameterized queries

---

## 3️⃣ Weak JWT Secret

- Hardcoded weak secret (`secret`)
- Tokens could be forged
- Fixed by enforcing strong environment-based secret

---

## 4️⃣ Missing Rate Limiting

- Unlimited login attempts
- Enabled brute-force attacks
- Fixed with request throttling middleware

---

## 5️⃣ Authorization Bypass (Privilege Escalation)

- Trusted `role` inside JWT
- Allowed forged admin tokens
- Fixed by verifying role from database

---

# 🛡 Security Principles Applied

- Proper JWT verification
- Strong secret management
- Parameterized SQL queries
- Rate limiting
- Server-side authorization enforcement
- Least privilege
- Defense in depth
- Do not trust client claims

---

# 🧪 Testing Attacks

Each vulnerability includes:

- Step-by-step reproduction
- Exploit commands
- Expected vulnerable behavior
- Post-fix validation

See:

```

/attacks
/fixes

```

---

# 📚 Threat Model (Simplified)

Assumed attacker capabilities:

- Authenticated user
- Ability to modify JWT payload
- Ability to send crafted HTTP requests
- No direct database access

Goals:

- Access other users' data
- Escalate privileges
- Extract unintended records
- Brute-force login

Mitigations implemented accordingly.

---

# 📈 What This Project Demonstrates

- Practical backend security awareness
- Ability to intentionally create and analyze vulnerabilities
- Understanding of OWASP Top 10
- Secure coding practices
- Strong debugging and verification methodology
- Clear documentation skills

---

# 🏷 OWASP Coverage

- A01 – Broken Access Control
- A03 – Injection
- A07 – Identification & Authentication Failures

---

# 👨‍💻 Author

Security-focused backend project built to demonstrate real-world vulnerability identification, exploitation, and remediation using modern Node.js architecture.

---

# 📌 Final Note

This project is intentionally educational.

It shows not only how vulnerabilities happen but how to fix them correctly.

Security is not about writing code.

It is about enforcing trust boundaries.