Api Key Exposure in Rocket with Saml

Rocket is a web framework for Rust, and it can integrate with SAML for authentication. When API keys are used within a Rocket application that also uses SAML, there are specific configurations and implementation patterns that can lead to accidental exposure of those keys. This occurs when SAML identity providers or service providers inadvertently pass or log sensitive data, or when Rocket routes or handlers expose keys through logs, error messages, or misconfigured endpoints.

One common scenario involves SAML responses containing embedded attributes that include API keys or tokens. If a SAML AttributeStatement includes an attribute such as api_key or access_token, and that response is processed without strict validation or sanitization, the key may be written to application logs or exposed through debug endpoints. For example, a Rocket route that logs the entire SAML response for troubleshooting purposes could inadvertently expose the key in plaintext:

#[post("/acs", data = <data>)]
fn acs(data: Data<String>) -> String {
    let saml_response = data.into_inner();
    info!("Received SAML response: {}", saml_response); // Risk: logs may contain API keys
    // Process SAML assertion...
    String::from("OK")
}

Additionally, if Rocket's fairings or logging configuration are not properly scoped, they may capture and store sensitive SAML attributes. Another risk arises when developers use SAML metadata or certificates as API keys for external services, storing them in configuration files that are checked into version control or exposed through the Rocket admin dashboard.

Misconfigured SAML bindings can also contribute to exposure. For instance, using HTTP redirect bindings for SAML responses that include sensitive attributes increases the risk of interception. If Rocket relies on such bindings and the response contains an API key in a query parameter, network observers or browser history may capture it.

Furthermore, when integrating third-party SAML libraries with Rocket, developers might inadvertently pass API keys through context objects or request guards. If these are serialized for logging or metrics without redaction, the keys become accessible to anyone with access to those logs.

These combinations highlight why it is critical to treat SAML responses as untrusted input and to apply strict filtering, validation, and redaction before any logging or external communication occurs within a Rocket application.

To prevent API key exposure in Rocket when using SAML, implement strict handling of SAML attributes and responses. Avoid logging raw SAML data, and ensure that any attribute containing sensitive information is either omitted or redacted before processing.

First, filter out sensitive attributes early in the SAML processing pipeline. Use a dedicated function to sanitize attributes before they are used or logged:

fn sanitize_saml_attributes(attributes: &HashMap<String, Vec<String>>) -> HashMap<String, Vec<String>> {
    let mut safe = HashMap::new();
    for (key, values) in attributes {
        if key.to_lowercase() == "api_key" || key.to_lowercase() == "access_token" {
            safe.insert(key.clone(),(vec!["[REDACTED]".to_string()]);
        } else {
            safe.insert(key.clone(), values.clone());
        }
    }
    safe
}

Second, ensure that SAML responses are not logged in full. Instead, log only necessary metadata:

#[post("/acs", data = <data>)]
fn acs(data: Data<String>) -> String {
    let saml_response = data.into_inner();
    // Parse SAML response safely using a library
    let parsed = parse_saml(&saml_response).expect("Invalid SAML");
    let safe_attrs = sanitize_saml_attributes(parsed.attributes);
    info!("SAML login successful for: {}", safe_attrs.get("email").unwrap_or(&vec!["unknown".to_string()])[0]);
    // Proceed with authentication...
    String::from("OK")
}

Third, configure SAML bindings and endpoints securely. Use HTTP POST bindings for SAML responses to prevent keys from appearing in URLs or browser history. In Rocket, this is typically enforced at the identity provider level, but ensure your endpoint only accepts POST:

#[post("/acs")]
fn acs() -> String {
    // Only POST allowed
    String::from("Method not allowed")
}

Fourth, store SAML certificates and metadata securely, and avoid using them as API keys. If external services require keys, use environment variables injected at runtime rather than embedding them in code or configuration files accessible through Rocket routes.

Finally, validate and sign SAML responses to ensure integrity. Use strong XML canonicalization and signature verification to prevent tampering that could inject malicious attributes containing fabricated API keys.