Fix Improper Assets Management in Feathers
Improper Assets Management in FeathersJS is the silent killer of microservices. It occurs when shadow services or legacy endpoints are left exposed, undocumented, and unauthenticated. Attackers exploit these 'forgotten' APIs to bypass security controls meant for the primary application. If you aren't explicitly governing your service registry and restricting provider access, you're leaving a back door open for anyone with a fuzzer.
The Vulnerable Pattern
const feathers = require('@feathersjs/feathers'); const express = require('@feathersjs/express');const app = express(feathers());
// VULNERABILITY: Shadow service registered without documentation or access control. // This service is automatically exposed via REST and Socket.io to the public internet. app.use(‘/admin-internal-metrics’, { async find() { return { status: ‘active’, env: process.env, db_connection: ‘connected’ }; } });
app.use(express.errorHandler()); app.listen(3030);
The Secure Implementation
To fix Improper Assets Management, you must implement two layers of defense: visibility and restriction. First, use 'feathers-swagger' to generate a live inventory of your API surface; if a service isn't in the docs, it shouldn't exist. Second, utilize Feathers hooks to inspect 'context.params.provider'. By checking if the provider is defined, you can distinguish between external requests (REST/WebSockets) and internal system calls. Use a global hook or a specific 'disallow' hook to ensure that internal utility services are never reachable from the outside world, effectively eliminating shadow APIs.
const { disallow, checkProvider } = require('feathers-hooks-common'); const swagger = require('feathers-swagger');const app = express(feathers());
// 1. Asset Inventory: Force documentation of all exposed services app.configure(swagger({ docsPath: ‘/api-docs’, specs: { info: { title: ‘Hardened API’, version: ‘1.0.0’ } } }));
app.use(‘/admin-internal-metrics’, new MetricsService());
// 2. Access Management: Restrict service to internal calls only app.service(‘admin-internal-metrics’).hooks({ before: { all: [ // Explicitly block all external providers (REST, Socket.io) // Only internal server-side calls (context.params.provider === undefined) allowed (context) => { if (context.params.provider) { throw new Error(‘Forbidden: Asset not managed for external access’); } } ] } });
Your Feathers API
might be exposed to Improper Assets Management
74% of Feathers apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.