Fix Improper Assets Management in LoopBack
Improper Assets Management (OWASP API9:2023) in LoopBack apps usually manifests as 'Shadow APIs' or 'Zombie Endpoints'—old versions or internal tools left exposed. In LoopBack 4, the biggest offenders are the auto-generated API Explorer and unversioned routes left active in production. If you aren't inventorying your routes and killing debug tools in prod, you're handing attackers a map to your internal logic.
The Vulnerable Pattern
import {RestExplorerBindings, RestExplorerComponent} from '@loopback/rest-explorer';export class MyApplication extends BootMixin(ServiceMixin(RepositoryMixin(RestApplication))) { constructor(options: ApplicationConfig = {}) { super(options);
// VULNERABILITY: API Explorer is enabled globally, including production. // This leaks the entire API schema and internal models to attackers. this.configure(RestExplorerBindings.COMPONENT).to({ path: '/explorer', }); this.component(RestExplorerComponent); // VULNERABILITY: No versioning. Old endpoints stay active indefinitely. this.projectRoot = __dirname;
} }
The Secure Implementation
The remediation strategy focuses on reducing the attack surface. First, we use environment-based logic to ensure the RestExplorerComponent is never mounted in production, preventing schema leakage. Second, we implement explicit base paths (e.g., /v1) to manage API lifecycles and prevent 'Zombie' endpoints from co-existing with new versions. Finally, we use LoopBack's metadata decorators to hide internal-only models and controllers from the public-facing OpenAPI documentation, ensuring that only sanctioned assets are visible to external consumers.
import {RestExplorerBindings, RestExplorerComponent} from '@loopback/rest-explorer';export class MyApplication extends BootMixin(ServiceMixin(RepositoryMixin(RestApplication))) { constructor(options: ApplicationConfig = {}) { super(options);
// FIX: Only enable Explorer in non-production environments if (process.env.NODE_ENV !== 'production') { this.configure(RestExplorerBindings.COMPONENT).to({ path: '/explorer', }); this.component(RestExplorerComponent); } // FIX: Enforce API versioning via base paths this.restServer.basePath('/v1'); // FIX: Explicitly hide sensitive models from OpenAPI spec // In the Controller/Model definition: // @model({settings: {hidden: true}}) // export class InternalLogs extends Entity { ... }
} }
Your LoopBack API
might be exposed to Improper Assets Management
74% of LoopBack apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.