Credential Stuffing in Rocket

Detecting credential stuffing vulnerabilities involves testing the authentication endpoint for the above patterns. middleBrick's unauthenticated black-box scan tests for this by:

• Rate Limit Absence: Sending a high volume of sequential login attempts (e.g., 100 requests with identical invalid credentials) from a single source and observing if all are accepted (200 OK) or if the server eventually throttles (429 Too Many Requests). No throttling indicates a high-risk finding.
• User Enumeration: Submitting requests with a known valid username but wrong password, and a completely random username/wrong password. Comparing HTTP status codes, response bodies, and response times. Identical responses (same status, similar body, similar latency) suggest the endpoint does not reveal user existence.
• MFA Bypass: After a successful first-factor login (using a known credential pair from a breach dataset), the scanner checks if subsequent requests to protected endpoints succeed without presenting a second factor. If the Auth guard accepts the session token without MFA validation, this is flagged.
• Session Handling: Analyzing Set-Cookie headers for session tokens. The scanner tests if the token is predictable (sequential, timestamp-based) or if it remains valid after logout/login cycles.

You can scan your Rocket API directly:

• Via Web Dashboard: Paste your API's login endpoint URL (e.g., https://api.example.com/login) into middleBrick's scanner.
• Via CLI: Run middlebrick scan https://your-rocket-app.com/login. The scan takes 5–15 seconds and returns a risk score with a category breakdown.
• In CI/CD: Add the middleBrick GitHub Action to your workflow to automatically scan staging endpoints before deployment. Example:
  

  jobs:
    security:
      runs-on: ubuntu-latest
      steps:
        - uses: middlebrick/scan@v1
          with:
            url: ${{ env.STAGING_URL }}
            fail_below_score: 80

  If the credential stuffing check fails, the action will exit with a non-zero code, failing the build.

middleBrick's report will highlight the specific missing controls (e.g., "No rate limiting on /login") and map the finding to OWASP API Top 10:2023 API2:2023 — Broken Authentication and PCI-DSS requirement 8.2.4.

Remediation should be implemented within your Rocket application code. middleBrick provides remediation guidance, but the fixes require code changes. Key Rocket-native solutions:

• Implement Rate Limiting: Use the rocket::fairing::AdHoc with a shared state (e.g., std::sync::Arc<Mutex<HashMap<String, (u32, Instant)>>>) or a crate like rocket-rate-limiter. A custom fairing example:
  

  use rocket::fairing::{self, Fairing, Info, Result as FairingResult};
  use rocket::http::{Header, Method, Status};
  use rocket::{Request, Response};
  use std::collections::HashMap;
  use std::sync::{Arc, Mutex};
  use std::time::{Duration, Instant};
  
  struct RateLimiter {
      attempts: Arc<Mutex<HashMap<String, (u32, Instant)>>>,
      max_attempts: u32,
      window: Duration,
  }
  
  #[rocket::async_trait]
  implement Fairing for RateLimiter {
      fn info(&self) -> Info { Info { name: "Rate Limiter", kind: Kind::Response } }
  
      async fn on_response<'r>(&self, req: &'r Request<'r>, res: &mut Response<'r>) {
          if req.method() == Method::Post && req.uri().path() == "/login" {
              let ip = req.client_ip().unwrap_or_else(|| "unknown".into());
              let mut attempts = self.attempts.lock().unwrap();
              let now = Instant::now();
              let entry = attempts.entry(ip.clone()).or_insert((0, now));
              if now.duration_since(entry.1) > self.window {
                  *entry = (1, now);
              } else {
                  entry.0 += 1;
                  if entry.0 > self.max_attempts {
                      res.set_status(Status::TooManyRequests);
                      res.set_header(Header::new("Retry-After", "60"));
                  }
              }
          }
      }
  }
  
  // Mount with: .attach(RateLimiter { attempts: Arc::new(Mutex::new(HashMap::new())), max_attempts: 5, window: Duration::from_secs(60) });

• Uniform Error Messages: Ensure the login response is identical for any authentication failure. In Rocket:
  

  #[post("/login", format = "json")]
  async fn login(creds: Json<LoginForm>) -> Result<Json<Token>, Status> {
      let user = match db.find_user(&creds.username, &creds.password).await {
          Some(u) => u,
          None => {
              // Always return same status and body, regardless of reason
              return Err(Status::Unauthorized);
          }
      };
      // ... success path
  }

  Returning HTTP 401 with an empty body prevents enumeration.
• Enforce MFA: After first-factor success, require a second factor. Store a flag in the session/token and check it in a guard:
  

  #[derive(FromForm, FromData)]
  pub struct MfaForm {
      token: String,
      code: String,
  }
  
  #[post("/login/mfa", data = "<MfaForm>")]
  async fn mfa_login(form: MfaForm, session: &Session<'_>) -> Result<Json<Token>, Status> {
      let user_id = session.get::<String>("mfa_user_id").ok_or(Status::Unauthorized)?;
      if mfa_service.verify(&user_id, &form.code).await {
          // Generate final token with MFA flag
          let token = generate_token(user_id, true);
          Ok(Json(token))
      } else {
          Err(Status::Unauthorized)
      }
  }
  
  // Guard that checks MFA
  #[rocket::async_trait]
  implement FromRequest<'r> for MfaGuard<'r> {
      type Error = ();
      async fn from_request(req: &'r Request<'r>) -> Request<'r>::Outcome<Self, Self::Error> {
          let token = req.guard::<AuthToken<'r>>().await.succeeded()?;
          if token.mfa_verified {
              Outcome::Success(MfaGuard)
          } else {
              Outcome::Failure((Status::Forbidden, ()))
          }
      }
  }

  Apply the MfaGuard to sensitive endpoints.
• Use Strong, Random Session Tokens: Generate tokens with a cryptographically secure RNG (e.g., ring::rand::SecureRandom). Avoid predictable values.
• Enforce Strong Passwords: Integrate a password strength library (e.g., zxcvbn) during user registration and password change.

After deploying fixes, re-scan with middleBrick's CLI or GitHub Action to verify the credential stuffing risk score improves. The Pro plan's continuous monitoring will alert you if rate limiting fails or is removed in a future deployment.