Clickjacking in Axum with Firestore

Clickjacking is a client-side UI redressing attack where an invisible or misleading interface element causes a victim to perform unintended actions. In an Axum application that uses Firestore as a backend, risk arises when server-rendered pages or API-driven endpoints embed Firestore-backed data without anti-clickjacking protections. An attacker can embed the target page in an <iframe> and overlay interactive elements, tricking a user who is authenticated into clicking a button that modifies Firestore data through Axum endpoints.

When Axum handlers directly render templates that pull Firestore documents (e.g., displaying or updating a user profile), the absence of frame-protection headers or UI isolation enables an attacker to craft a malicious page that loads the legitimate route inside a frame. Because Axum does not enforce authentication on the server side for these routes, the browser automatically sends cookies, and the Firestore operations triggered via Axum endpoints execute in the victim’s context. If the Firestore rules are misconfigured to allow write access based solely on the user’s authenticated identity, the attacker can perform unauthorized updates, demonstrating why unauthenticated attack surface scans and checks like those in middleBrick are relevant to surface missing frame protections and insecure integration patterns.

Consider an Axum handler that retrieves a Firestore document to pre-fill a form:

use axum::{routing::get, Router};
use firestore::*;
use serde::Deserialize;

async fn profile_handler() -> String {
    let db = FirestoreDb::new("my-project").unwrap();
    let doc: FirestoreDocument = db.get_doc(&format!("users/{}", user_id)).await.unwrap();
    format!(
        "
",
        doc.field("email")
    )
}

If this page is served without Content-Security-Policy frame-ancestors or X-Frame-Options, an attacker can embed it and overlay a transparent button that submits the form, changing the email in Firestore via the corresponding Axum POST handler. Because the scan types in middleBrick include UI redressing checks among its 12 parallel security checks, such missing defenses are surfaced as actionable findings with remediation guidance, emphasizing headers and frame isolation to protect Firestore-backed Axum endpoints.

Remediation focuses on two layers: HTTP headers to prevent framing, and secure Firestore access patterns in Axum handlers. Headers ensure the browser refuses to render the page in a frame, while correct Rust patterns reduce risk from inadvertent data exposure or insecure Firestore rules usage.

1) Add anti-clickjacking headers in Axum

Use middleware or a wrapper layer to set X-Frame-Options and Content-Security-Policy frame-ancestors. For Axum, a simple tower layer or axum::middleware can enforce these on all responses that render Firestore-backed content:

use axum::{http::HeaderValue, middleware::Next, response::Response, Json, Router};
use std::convert::Infallible;

async fn frame_protection_layer(req: axum::http::Request, next: Next) -> Response
where
    B: Send + 'static,
{
    let mut res = next.run(req).await;
    res.headers_mut().insert(
        "X-Frame-Options",
        HeaderValue::from_static("DENY"),
    );
    res.headers_mut().insert(
        "Content-Security-Policy",
        HeaderValue::from_static("frame-ancestors 'none'"),
    );
    res
}

fn app() -> Router {
    Router::new()
        .route("/profile", get(profile_handler))
        .layer(axum::middleware::from_fn(frame_protection_layer))
}

use axum::{routing::post, Json, Router};
use firestore::*;
use serde::Deserialize;

#[derive(Deserialize)]
struct UpdateEmail {
    email: String,
    user_id: String,
}

async fn update_email_handler(
    Json(payload): Json,
) -> Result, (axum::http::StatusCode, String)> {
    let db = FirestoreDb::new("my-project").map_err(|e| (axum::http::StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
    // Ensure the authenticated caller matches the Firestore document
    if payload.user_id != get_authenticated_user_id() {
        return Err((axum::http::StatusCode::FORBIDDEN, "Unauthorized".to_string()));
    }
    db.update_doc(
        &format!("users/{}", payload.user_id),
        &firestore::UpdateRef::update_all(&[("email", payload.email.into())]),
    ).await.map_err(|e| (axum::http::StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
    Ok(Json(()))
}