Account Lockout and Enumeration Prevention

Course Path Overview

This course path focuses on OWASP Top 10 Risks & Common Attack Vectors (6-10), serving as a continuation of the foundational path OWASP Top 10 Common Attack Vectors with TypeScript (1-5) . While the previous path covered the first five critical security risks, this path concentrates primarily on: A07: Identification and Authentication Failures - Covered comprehensively across authentication and MFA courses A08: Software and Data Integrity Failures - Addressed through data handling and web resource integrity courses A10: Server-Side Request Forgery (SSRF) - Dedicated course for prevention techniques We also touch on A06: Vulnerable and Outdated Components and A09: Security Logging and Monitoring Failures where relevant. This path focuses specifically on the technical implementation aspects that software developers can directly control through code. While A06 and A09 also involve significant responsibilities for specialized roles like Application Security Engineers, DevOps Engineers, and Security Analysts, we concentrate on the developer-centric technical components rather than the broader organizational processes and infrastructure management these risks encompass.

Introduction

Welcome to the very first lesson of the "Secure Authentication and Authorization in Express with TypeScript" course! In this lesson, we will explore the critical security measures of account lockout and enumeration prevention . These strategies are essential for protecting your web applications from unauthorized access and data breaches. By understanding and implementing these measures, you'll be better equipped to safeguard your applications against common attack vectors. Let's dive in! 🚀

Understanding the Vulnerabilities

As we have already encountered in previous courses, one of the most common vectors for attackers is stealing account credentials. Suppose the login page of an app has multiple fields and provides varying error messages when different credentials are entered. For example, it might sometimes indicate that the username does not exist, other times that the email is incorrect, and occasionally that the password is incorrect. This behavior can reveal that some credentials pass certain checks while others do not, inadvertently disclosing that a user is registered with a specific email. This issue can occur even with just username and password fields. If the application sometimes states that a username is not in the database and other times that the password is incorrect, an attacker can deduce the set of usernames registered in the app and subsequently attempt to discover the corresponding passwords. This is known as an enumeration attack. Enumeration attacks involve discovering valid usernames or other sensitive information through error messages or response times. Attackers can use this information to gain unauthorized access to your application.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Exploiting Vulnerabilities

An attacker can easily exploit these vulnerabilities by manipulating login attempts or error messages. Here is an example:

Vulnerable Code:

TypeScript

// Login endpoint
router.post('/login', async (req, res) => {
  try {
    const { username, password } = req.body;
    const user = await User.findOne({ where: { username } });

    if (!user) {
      // Different error message for non-existent username
      return res.status(404).json({ error: 'Username does not exist' });
    }

    const isPasswordValid = await bcrypt.compare(password, user.password);
    if (!isPasswordValid) {
      // Different error message for incorrect password
      return res.status(401).json({ error: 'Incorrect password' });
    }

    const token = jwt.sign({ userId: user.id }, JWT_SECRET_KEY);
    return res.json({ token });
  } catch (error) {
    console.error("Error during login:", error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

In this example, the application returns a 404 status with a specific error message if the username does not exist and a 401 status with a different message if the password is incorrect. This behavior allows attackers to determine which usernames are valid by observing the error messages, making the application vulnerable to enumeration attacks.

Enumeration Attack:
Shell
```
# Checking for valid usernames by observing error messages
for username in $(cat usernames.txt); do
  response=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" -d "{\"username\":\"$username\",\"password\":\"wrongpassword\"}" http://example.com/login)

  if [ "$response" == "401" ]; then
    echo "$username" >> app_usernames.txt
  fi
done
```
In this script, the curl command is used to send a POST request, and the -w "%{http_code}" option captures the HTTP status code. If the response code is 401, which typically indicates "Unauthorized" but may suggest a valid username with an incorrect password, the username is appended to app_usernames.txt. This way, the script logs valid usernames based on the server's response.

Step 2: Implement Lockout Logic

We'll implement the logic to lock an account after too many failed attempts.

TypeScript

// Check if account is locked
if (lockedAccounts[username] && Date.now() < lockedAccounts[username]) {
  return res.status(429).json({
    error: 'Account temporarily locked. Please try again later.'
  });
}

// Check if account is locked
if (lockedAccounts[username] && Date.now() < lockedAccounts[username]) {
  return res.status(429).json({
    error: 'Account temporarily locked. Please try again later.'
  });
}

In this code snippet, we first check if the account is already locked by verifying if there is an entry in the lockedAccounts object for the given username. We also compare the current time (Date.now()) with the lockout expiration time stored in lockedAccounts[username]. If the current time is less than the expiration time, it means the account is still locked, and we return a 429 status code with an appropriate error message.

TypeScript

// Increment failed attempts
failedAttempts[username] = (failedAttempts[username] || 0) + 1;

// Increment failed attempts
failedAttempts[username] = (failedAttempts[username] || 0) + 1;

Here, we increment the count of failed login attempts for the username. We use the logical OR (||) operator to initialize the count to 0 if it doesn't already exist, ensuring that the count starts from zero for new entries.

TypeScript

// Lock account if threshold is reached
if (failedAttempts[username] >= LOCK_THRESHOLD) {
  lockedAccounts[username] = Date.now() + LOCK_DURATION;
  return res.status(429).json({
    error: 'Account temporarily locked. Please try again later.'
  });
}

// Lock account if threshold is reached
if (failedAttempts[username] >= LOCK_THRESHOLD) {
  lockedAccounts[username] = Date.now() + LOCK_DURATION;
  return res.status(429).json({
    error: 'Account temporarily locked. Please try again later.'
  });
}

In this part, we check if the number of failed attempts has reached or exceeded the predefined LOCK_THRESHOLD. If it has, we lock the account by setting an expiration time in the lockedAccounts object, calculated as the current time plus the LOCK_DURATION. We then return a 429 status code with a message indicating that the account is temporarily locked.

Course Path Overview

Introduction

Understanding the Vulnerabilities

Join the 1M+ learners on CodeSignal

Exploiting Vulnerabilities

Defensive Strategies: Preventing Enumeration Attacks

Understanding Brute Force Attacks And Account Locking

Exploiting Brute Force Vulnerabilities

Defensive Strategies: Implementing Account Lockout

Step 1: Track Failed Attempts

Step 2: Implement Lockout Logic

Step 3: Reset Failed Attempts on Successful Login

Conclusion and Next Steps