Fix Insecure API Management in Feathers

FeathersJS is built on a 'service' architecture that automatically generates REST and Socket.io endpoints. The critical failure point is the 'hooks' pipeline. By default, services are often left wide open, allowing unauthenticated attackers to perform CRUD operations on sensitive data or escalate privileges via Mass Assignment. To secure Feathers, you must adopt a 'Deny by Default' posture using the middleware hook system.

The Vulnerable Pattern

// src/services/users/users.hooks.js
module.exports = {
  before: {
    all: [], // ERROR: No authentication globally applied
    find: [],
    get: [],
    create: [], // ERROR: Anyone can create an admin user
    update: [],
    patch: [],
    remove: []
  }
};

The Secure Implementation

The fix targets three attack vectors: 1. Broken Function Level Authorization: We use 'authenticate' and 'checkPermissions' to ensure only valid JWT holders with specific roles can touch the service. 2. Mass Assignment: The 'preventChanges' hook stops users from overwriting sensitive fields like 'roles' or 'email' during update/patch requests. 3. Data Leakage: The 'discard' hook in the 'after' phase ensures that even if a query is successful, internal fields like hashed passwords never leave the server. Always place authentication hooks at the top of the 'all' array to ensure no logic executes for unverified sessions.

const { authenticate } = require('@feathersjs/authentication').hooks;
const { checkPermissions } = require('feathers-permissions');
const { preventChanges, discard } = require('feathers-hooks-common');
module.exports = {
before: {
all: [ authenticate(‘jwt’) ], // Force auth for all endpoints
find: [ checkPermissions({ roles: [‘admin’] }) ],
get: [ checkPermissions({ roles: [‘admin’, ‘user’] }) ],
create: [ checkPermissions({ roles: [‘admin’] }) ],
update: [ checkPermissions({ roles: [‘admin’] }), preventChanges(true, ‘email’, ‘roles’) ],
patch: [ checkPermissions({ roles: [‘admin’] }), preventChanges(true, ‘email’, ‘roles’) ],
remove: [ checkPermissions({ roles: [‘admin’] }) ]
},
after: {
all: [ discard(‘password’, ‘_v’) ] // Prevent sensitive data leakage
}
};