Api Key Exposure in Actix with Mysql

Actix is a high-performance Rust web framework that often interacts with backend databases such as MySQL. When API keys are handled in Actix applications that also use MySQL, exposure can occur through insecure logging, improper error handling, or serialization practices that leak sensitive data into responses or logs. A common pattern is to pass an API key as a query parameter or header to authenticate requests to a downstream service, while also using a MySQL connection to store or retrieve related configuration or audit data.

For example, consider an Actix handler that accepts an API key via an HTTP header, forwards it to another service, and also writes the key (even partially) into a MySQL table for debugging. If the logging or SQL query construction is not carefully managed, the key may be exposed in application logs or through verbose error messages returned to the client. An attacker who can read logs or trigger error responses may obtain the key. This is particularly risky when the Actix application uses string formatting or concatenation to build SQL queries, which can inadvertently include sensitive values in log output or error traces.

The combination of Actix and MySQL can amplify exposure when developers inadvertently store or echo API keys in database columns without proper protection. Even if the database is secured, the exposure surface increases if the Actix application serializes request data into JSON responses that include raw keys for convenience. MiddleBrick scans detect such patterns by correlating runtime behavior with OpenAPI specifications and flagging endpoints that handle sensitive credentials without adequate input validation or output encoding.

Additionally, if the Actix application uses environment variables or configuration files to load MySQL credentials, those same mechanisms may also be used to manage API keys. Misconfigured permissions or overly permissive logging settings can cause these keys to be written to stdout or files, where they become accessible to unauthorized users. MiddleBrick’s LLM/AI Security checks specifically look for system prompt leakage and output scanning to ensure that API keys are not echoed back in LLM responses or exposed through unchecked endpoints.

In practice, the risk arises not from MySQL itself, but from how Actix code handles, logs, or transmits API keys when interacting with the database. Proper separation of concerns, strict input validation, and secure logging practices are essential to prevent inadvertent disclosure. MiddleBrick’s scan provides prioritized findings with severity and remediation guidance to help identify and mitigate such exposures in the unauthenticated attack surface.

To remediate API key exposure in Actix when using MySQL, developers should ensure that API keys are never logged, echoed in error messages, or stored in plain text. Use prepared statements to avoid SQL injection and prevent keys from appearing in query logs. Below are concrete code examples demonstrating secure handling in Actix with MySQL.

First, use parameterized queries instead of string interpolation. This prevents keys from being parsed as SQL syntax and reduces the risk of accidental logging. Here is an example using the mysql crate in Rust:

use mysql::*;
use mysql::prelude::*;

async fn store_api_key(pool: &Pool, user_id: u64, api_key: &str) -> Result<()> {
    let mut conn = pool.get_conn()?;
    conn.exec_drop(
        "INSERT INTO api_keys (user_id, key_hash) VALUES (:user_id, :key_hash)",
        params! {
            "user_id" => user_id,
            "key_hash" => hash_key(api_key), // store a hash, not the raw key
        },
    )?;
    Ok(())
}

Second, avoid logging API keys explicitly. If logging is necessary for debugging, mask or hash the key. For example:

fn log_api_key(key: &str) {
    use std::hash::{Hash, Hasher};
    let mut hasher = std::collections::hash_map::DefaultHasher::new();
    key.hash(&mut hasher);
    let hash = hasher.finish();
    log::info!(“API key hash: {}”, hash);
}

Third, ensure that error responses do not include stack traces or variable values that might contain the key. Use custom error types that sanitize output before serialization:

use actix_web::{error, ResponseError};
use serde::Serialize;

#[derive(Debug, Serialize)]
struct ApiError {
    message: String,
}

impl ResponseError for ApiError {
    fn error_response(&self) -> actix_web::HttpResponse {
        actix_web::HttpResponse::BadRequest().json(self)
    }
}

fn handle_key_error() -> ApiError {
    ApiError {
        message: “Invalid request”.to_string(),
    }
}

Finally, rotate keys regularly and restrict database user permissions to the minimum required. In the MySQL database, grant only necessary privileges to the Actix application’s database user:

CREATE USER 'actix_app'@'localhost' IDENTIFIED WITH mysql_native_password BY 'secure_password';
GRANT SELECT, INSERT ON app_db.api_keys TO 'actix_app'@'localhost';
FLUSH PRIVILEGES;

These practices reduce the likelihood of API key exposure and align with secure coding standards. MiddleBrick scans can validate these configurations and highlight remaining risks in the application’s security posture.