Arp Spoofing in Axum with Openid Connect

Arp spoofing is a link-layer attack where an attacker sends falsified ARP messages to associate their MAC address with the IP address of another host, typically the default gateway. In an Axum service that uses OpenID Connect (OIDC) for authentication, arp spoofing can undermine the confidentiality and integrity of the authentication flow even before TLS is terminated. If an attacker sits in the same local network segment as the client or the API server, they can intercept unencrypted ARP traffic and redirect OIDC requests or responses.

When a client application (e.g., a web frontend or a mobile app) initiates an OIDC authorization request to an identity provider (IdP), the request often traverses the local network to reach a gateway or proxy. With arp spoofing active, the attacker can position themselves in this path and observe or modify HTTP redirects that carry authorization codes. Because the initial redirect from Axum endpoints (e.g., /login/oauth/authorize) often uses standard HTTP before redirecting to the IdP, the attacker may capture the authorization code or tamper with redirect URIs, leading to authorization code interception or redirection to malicious endpoints.

Moreover, arp spoofing can expose metadata about the OIDC configuration in use. An attacker may intercept requests to well-known OpenID configuration endpoints (e.g., /.well-known/openid-configuration) and serve altered discovery documents. This can trick the client into using attacker-controlled keys or endpoints, undermining the trust chain provided by OIDC. Even when TLS is used, if certificate validation is misconfigured in the Axum client, the attacker might present a valid certificate for a different hostname and still complete the handshake, especially in environments where custom root CAs are trusted.

In Axum-based services that rely on session cookies after OIDC authentication, arp spoofing can facilitate session hijacking. Once the attacker has intercepted the authorization code or tokens, they can exchange the code for tokens at the token endpoint. If the token endpoint response is intercepted, the attacker may obtain access tokens or ID tokens, which can then be used to impersonate users. This risk is heightened when rate limiting or IP-based anomaly detection is not enforced, allowing the attacker to reuse intercepted tokens within their validity window.

While Axum does not provide built-in network-layer protections, developers can mitigate arp spoofing risks by ensuring all OIDC redirects use HTTPS with strict transport security, enforcing certificate pinning where feasible, and isolating authentication endpoints within private networks. Using runtime security scanning tools like middleBrick can help detect unusual patterns in authentication traffic that may indicate active interception or manipulation during the OIDC flow.

To secure OpenID Connect flows in Axum, apply transport hardening and strict validation at each step of the OAuth/OIDC sequence. The following examples demonstrate a secure OIDC integration using the oauth2 crate, with HTTPS enforcement and state parameter validation.

1. Configure the OIDC client with strict redirect URIs and HTTPS

Always use HTTPS for redirect URIs and register them explicitly in your IdP configuration. This prevents open redirects and ensures that authorization codes are delivered only to trusted endpoints.

use oauth2::{basic::BasicClient, AuthUrl, ClientId, ClientSecret, RedirectUrl};
use url::Url;

let client_id = ClientId::new("your-client-id".to_string());
let client_secret = ClientSecret::new("your-client-secret".to_string());
let auth_url = AuthUrl::new("https://idp.example.com/auth".to_string()).unwrap();

// Ensure the redirect URL is exact and uses HTTPS
let redirect_url = RedirectUrl::new("https://api.example.com/login/oauth/callback".to_string()).unwrap();

let client = BasicClient::new(client_id, Some(client_secret), auth_url, None)
    .set_redirect_uri(redirect_url);

2. Validate the state parameter to prevent CSRF

Generate and verify a cryptographically random state value for each authorization request. Store it server-side (e.g., in a session) and validate it upon callback to prevent cross-site request forgery during the OIDC handshake.

use rand::Rng;
use std::collections::HashMap;

// Generate state
let state: String = rand::thread_rng()
    .sample_iter(&rand::distributions::Alphanumeric)
    .take(32)
    .map(char::from)
    .collect();

// Store state in session before redirect
session.insert("oauth_state", state.clone());

let (auth_url, _csrf_token) = client.authorize_url(CsrfToken::new_random)
    .add_scope(oauth2::Scope::new("openid".to_string()))
    .url();

// Later, in the callback handler
let received_state = "state_from_callback";
if Some(received_state) != session.get::("oauth_state") {
    // Reject request: invalid state
}

3. Enforce nonce and validate ID token claims

When requesting OpenID scopes, include openid and pass a nonce to bind the ID token to the client session. Validate the nonce and standard claims (iss, aud, exp) in your callback handler to ensure the token is intended for your application.

use oauth2::reqwest::async_http_client;
use openidconnect::{CoreAuthenticationFlow, CoreIdToken, Nonce};

let (auth_url, csrf_token) = client
    .authorize_url(|| {
        let nonce: Nonce = Nonce::new_random();
        session.insert("oauth_nonce", nonce.secret().clone());
        nonce
    })
    .add_scope(openidconnect::Scope::new("openid".to_string()))
    .url();

// After receiving the code, exchange it for tokens
let token_result = client.exchange_code(oauth2::AuthorizationCode::new(code))
    .request_async(async_http_client)
    .await;

let id_token = token_result?.id_token().expect("missing id_token");
let claims = id_token.claims(&client.id_token_verifier(), &nonce)?;
if claims.issuer().as_str() != "https://idp.example.com" {
    // Reject: invalid issuer
}

4. Isolate authentication routes and enforce HTTPS

In Axum, route authentication handlers to a dedicated scope and enforce HTTPS using middleware or deployment configuration. This reduces the attack surface exposed to network-level interference like arp spoofing.

use axum::routing::get;
use axum::Router;

let app = Router::new()
    .route("/login/oauth/authorize", get(auth_handler))
    .route("/login/oauth/callback", post(callback_handler))
    .layer(/* HTTPS enforcement layer */);