Arp Spoofing in Actix with Basic Auth

Arp spoofing is an L2 network attack where an adversary sends falsified Address Resolution Protocol replies to associate their MAC address with the IP of a legitimate host, such as a gateway or another service. In an Actix web service that uses HTTP Basic Authentication, this attack can undermine transport trust by allowing the attacker to intercept or modify unencrypted traffic between the client and the server. Basic Auth transmits credentials as base64-encoded values in the Authorization header; while not inherently secret without TLS, the risk is compounded when arp spoofing enables an attacker on the same local network to observe or inject traffic before it reaches the intended endpoint.

In a typical deployment, Actix applications listen on a network interface that is shared with other hosts (e.g., within a container network or a virtualized environment). If arp spoofing is successful, the attacker can position themselves as a man-in-the-middle on the local segment. Because Basic Auth does not encrypt the credentials, the attacker can capture the base64 string and attempt to decode it offline to recover the username and password. Even if the application is ultimately served over HTTPS, arp spoofing at the L2 layer can be used to redirect or alter requests before they reach the TLS termination point, enabling session hijacking or injection of malicious requests that the server processes with the privileges of the stolen credentials.

middleBrick scanning an Actix endpoint using Basic Auth without TLS will flag findings in the Encryption and Data Exposure checks, noting that credentials are transmitted in a reversible encoding and that unauthenticated network attacks like arp spoofing can expose them. The scanner also highlights risks in Authentication and Input Validation, since intercepted credentials may be reused and manipulated. These findings map to real-world attack patterns such as credential theft and session hijacking, which are described in the OWASP API Top 10 and can be tied to relevant CVEs involving weak network segmentation or lack of enforced transport protection.

To mitigate arp spoofing risks when using Basic Auth in Actix, enforce HTTPS for all traffic so that credentials are encrypted in transit and integrity-protected by TLS. Never allow Basic Auth over plain HTTP in production environments. Use HTTP Strict Transport Security (HSTS) to prevent downgrade attacks, and ensure server certificates are valid and pinned where feasible. In addition to transport protections, avoid embedding long-term credentials in code; instead, use short-lived tokens or integrate with an identity provider that supports modern flows, reducing the impact of intercepted credentials.

Below are concrete Actix examples that demonstrate secure handling of Basic Auth over HTTPS, including how to reject cleartext HTTP and enforce secure authentication.

Secure Actix HTTPS server with Basic Auth

use actix_web::{web, App, HttpResponse, HttpServer, middleware::Logger};
use actix_web::http::header;
use base64::decode;

async fn auth_middleware(req: actix_web::HttpRequest, payload: web::Payload) -> Result<(), actix_web::Error> {
    // Enforce HTTPS in production; reject cleartext HTTP
    if !req.connection_info().secure() {
        return Ok(HttpResponse::Forbidden().body("HTTPS required"));
    }

    if let Some(auth_header) = req.headers().get(header::AUTHORIZATION) {
        if let Ok(auth_str) = auth_header.to_str() {
            if auth_str.starts_with("Basic ") {
                let encoded = auth_str.trim_start_matches("Basic ");
                if let Ok(decoded) = decode(encoded) {
                    if let Ok(credentials) = String::from_utf8(decoded) {
                        let parts: Vec<&str> = credentials.splitn(2, ':').collect();
                        if parts.len() == 2 && parts[0] == "admin" && parts[1] == "s3cur3P@ss!" {
                            return Ok(());
                        }
                    }
                }
            }
        }
    }
    Err(actix_web::error::ErrorUnauthorized("Invalid credentials"))
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    std::env::set_var("RUST_LOG", "actix_web=info");
    env_logger::init();

    HttpServer::new(|| {
        App::new()
            .wrap(Logger::default())
            .route("/secure", web::get().to(|| async { HttpResponse::Ok().body("Authenticated") }))
            .default_service(web::route().to(auth_middleware))
    })
    .bind_openssl("127.0.0.1:8443", {
        use openssl::ssl::{SslAcceptor, SslFiletype, SslMethod};
        let mut builder = SslAcceptor::mozilla_intermediate(SslMethod::tls()).unwrap();
        builder.set_private_key_file("key.pem", SslFiletype::PEM).unwrap();
        builder.set_certificate_chain_file("cert.pem").unwrap();
        builder.build()
    })?
    .run()
    .await
}

Rejecting non-TLS requests at the Actix level

use actix_web::{web, App, HttpResponse, HttpServer};
use actix_web::dev::ServiceRequest;
use actix_web::error::ErrorForbidden;
use actix_web::middleware::Next;

async fn enforce_https(req: ServiceRequest, next: Next) -> Result {
    if !req.connection_info().secure() {
        return Err(ErrorForbidden("HTTPS required to prevent network interception such as arp spoofing"));
    }
    next.call(req).await
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    HttpServer::new(|| {
        App::new()
            .wrap_fn(|req, next| enforce_https(req, next))
            .route("/api/data", web::get().to(|| async { HttpResponse::Ok().json(&["ok"]) }))
    })
    .bind("127.0.0.1:8080")?
    .run()
    .await
}

These examples show how to integrate Basic Auth checks with transport security in Actix. The first sample uses OpenSSL bindings to require HTTPS and validate credentials, while the second demonstrates middleware that rejects non-TLS requests. By combining these practices with network-level protections, you reduce the feasibility and impact of arp spoofing against Basic Auth endpoints.