Api Rate Abuse in Rocket with Bearer Tokens

Rate abuse in the Rocket framework becomes more severe when endpoints rely on Bearer token authentication. Rocket guards are typically applied at the route or guard level, but if rate-limiting logic is not enforced before or alongside authentication, an unauthenticated or low-cost attacker can make many requests using a single stolen or leaked Bearer token. This exposes account takeover or brute-force risks when tokens are weak, leaked, or improperly scoped.

Because Rocket is asynchronous and uses extractors, it is easy to forget to attach a per-user or per-token rate limit. Without a mechanism to key rate limits to the Bearer token or to associate the token with a user identity early in the request lifecycle, an attacker can send many requests that are attributed to the same token. This can lead to denial of service, credential stuffing, or abuse of operations that act on behalf of the token holder.

In black-box scanning, middleBrick tests for missing or inconsistent rate limiting by probing endpoints with repeated requests, including attempts that rotate tokens or omit tokens where authentication is required. When Bearer tokens are accepted but not tied to a rate-limiting key, findings such as missing Authentication and Rate Limiting controls are surfaced. This is especially important for high-risk endpoints such as login, password reset, or token refresh, where abuse can amplify other vulnerabilities like IDOR or privilege escalation.

Proper instrumentation ties the token value (or its associated user ID) into the rate-limiting key, ensuring that each token or user is subject to a shared quota. Without this, even strong authentication provides no protection against rapid, abusive use of valid credentials.

Remediation focuses on ensuring every request carrying a Bearer token is subjected to rate limiting keyed by the token or its owning user. In Rocket, this is typically done by implementing a custom guard or integrating a rate-limiting layer before the handler executes. Below are concrete, realistic examples that show how to structure the code.

Example 1: Using a custom request guard with token extraction and rate-limiting key

use rocket::request::{self, FromRequest, Request};
use rocket::http::Status;
use std::time::Duration;
use std::collections::HashMap;
use std::sync::Mutex;

struct AuthenticatedUser {
    user_id: String,
    token_key: String,
}

#[rocket::async_trait]
impl<'r> FromRequest<'r> for AuthenticatedUser {
    type Error = ();

    async fn from_request(request: &'r Request<'_>) -> request::Outcome {
        let token = match request.headers().get_one("authorization") {
            Some(t) if t.starts_with("Bearer ") => &t[7..],
            _ => return request::Outcome::Error((Status::Unauthorized, ())),
        };

        // Validate token against a store (e.g., database or cache).
        // For this example, assume valid token maps to a user.
        if is_valid_token(token).await {
            let user_id = lookup_user_id(token).await.unwrap_or_default();
            let token_key = format!("rate_limit:{}", token);
            request::Outcome::Success(AuthenticatedUser { user_id, token_key })
        } else {
            request::Outcome::Error((Status::Unauthorized, ()))
        }
    }
}

// Simple in-memory rate limiter (use Redis or similar in production).
struct RateLimiter {
    counts: Mutex>,
}

impl RateLimiter {
    fn new() -> Self {
        Self { counts: Mutex::new(HashMap::new()) }
    }

    fn allow(&self, key: &str, limit: usize, window: Duration) -> bool {
        let mut counts = self.counts.lock().unwrap();
        let entry = counts.entry(key.to_string()).or_insert((0, Instant::now()));
        if entry.1.elapsed() > window {
            entry.0 = 1;
            entry.1 = Instant::now();
            true
        } else if entry.0 < limit {
            entry.0 += 1;
            true
        } else {
            false
        }
    }
}

#[rocket::main]
async fn main() {
    let limiter = RateLimiter::new();
    rocket::build()
        .manage(limiter)
        .mount("/", routes![protected])
        .launch()
        .await;
}

#[rocket::get("/account")]
async fn protected(user: AuthenticatedUser, limiter: &State<RateLimiter>) -> String {
    let per_token_limit = 60;
    let window = Duration::from_secs(60);
    if limiter.allow(&user.token_key, per_token_limit, window) {
        format!("Access for user: {}", user.user_id)
    } else {
        rocket::http::Status::TooManyRequests.into()
    }
}

async fn is_valid_token(token: &str) -> bool {
    // Replace with real token validation.
    token == "valid_token_abc"
}

async fn lookup_user_id(token: &str) -> Option<String> {
    Some("user-123".to_string())
}

use rocket::request::Request;
use rocket::outcome::Outcome;
use rocket::http::Status;
use rocket::request::FromRequest;
use rocket::State;
use serde_json::Value;

struct TokenClaims {
    sub: String,
    scope: String,
}

struct TokenAuth {
    claims: TokenClaims,
}

#[rocket::async_trait]
impl<'r> FromRequest<'r> for TokenAuth {
    type Error = Value;

    async fn from_request(request: &'r Request<'_>) -> Outcome {
        let token = match request.headers().get_one("authorization") {
            Some(t) if t.starts_with("Bearer ") => &t[7..],
            _ => return Outcome::Error((Status::Unauthorized, json!({ "error": "missing_token" }))),
        };

        // Decode and validate token (pseudo-code).
        let claims = decode_token(token).await;
        match claims {
            Some(c) => Outcome::Success(TokenAuth { claims: c }),
            None => Outcome::Error((Status::Unauthorized, json!({ "error": "invalid_token" }))),
        }
    }
}

async fn decode_token(token: &str) -> Option {
    // Replace with real JWT decoding and validation.
    if token == "valid_token_xyz" {
        Some(TokenClaims { sub: "user-456".to_string(), scope: "api:read".to_string() })
    } else {
        None
    }
}

// Route using the guard; apply per-subject rate limiting.
#[rocket::get("/data")]
async fn get_data(auth: TokenAuth, limiter: &State<RateLimiter>) -> String {
    let limit = 30;
    let window = Duration::from_secs(60);
    if limiter.allow(&format!("user:{}", auth.claims.sub), limit, window) {
        format!("Data for {}", auth.claims.sub)
    } else {
        rocket::http::Status::TooManyRequests.into()
    }
}