Credential Stuffing in Rocket with Bearer Tokens

Credential stuffing is an automated attack where valid credentials from one breach are replayed against a target system to gain unauthorized access. When an API service like Rocket relies exclusively on Bearer tokens for authentication, the risk profile changes in ways that differ from cookie-based or session-based flows. Bearer tokens are static secrets that, once issued, are expected to be kept confidential and are valid until expiration or revocation. If a token is leaked—whether through client-side code, logs, insecure storage, or a compromised third-party service—an attacker can directly impersonate the associated identity without any additional credentials.

Rocket applications often integrate external identity providers or custom auth layers that issue Bearer tokens. If these tokens lack binding to a particular client context (such as IP address or TLS channel binding), an attacker who obtains a token can reuse it from any location. Credential stuffing in this context shifts from username/password guessing to token reuse at scale: attackers take a list of known token leaks or tokens obtained via other compromises and replay them against Rocket endpoints that do not enforce strict scope or origin validation. Because Bearer tokens are typically long-lived compared to session cookies, the window for abuse can be extensive if revocation mechanisms are slow or inconsistent.

The exposure is amplified when Rocket services do not enforce per-request token validation best practices, such as checking token binding, audience restrictions, or issuer claims. An API that accepts any well-formed Bearer token over HTTPS but does not validate scopes or resource ownership enables horizontal privilege escalation across users. For example, a token issued for read-only access might be accepted for write operations if endpoint-level authorization is missing. Attackers conducting credential stuffing against Rocket will look for these gaps—missing token binding, missing audience/issuer checks, missing rate limiting on token usage—to determine whether a leaked token can be leveraged for broader access.

Moreover, Rocket applications that expose unauthenticated endpoints or introspection endpoints without proper access controls may inadvertently aid attackers in mapping valid tokens. If an endpoint returns distinct error messages for missing versus invalid tokens, it can be used to enumerate valid tokens as part of a stuffing campaign. The combination of weak token lifecycle management and inconsistent authorization enforcement means that credential stuffing against Rocket with Bearer tokens can lead to account takeover, data exposure, and unauthorized actions across integrated services.

Effective detection requires correlating token usage patterns—such as repeated use of the same token across diverse origins or IPs—with authorization failures logged by Rocket. Because Bearer tokens do not inherently carry contextual binding, monitoring and anomaly detection become critical. Organizations should validate token audiences, enforce short lifetimes where feasible, and implement token revocation mechanisms to reduce the impact of leaked credentials in stuffing attacks.

Remediation for Bearer token vulnerabilities in Rocket focuses on tightening token validation, binding, and authorization. Below are concrete patterns and code examples that address common weaknesses. These examples assume a typical Rocket handler using JSON Web Tokens (JWT) and the jsonwebtoken crate for validation.

1. Validate issuer, audience, and scopes on every request

Ensure each Bearer token is validated against expected issuer (iss), audience (aud), and required scopes. This prevents token reuse across different services or clients.

use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation, TokenData, Header};
use rocket::Request;
use rocket::fairing::AdHoc;
use rocket::Outcome;
use rocket::request::{self, FromRequest};

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Claims {
    pub sub: String,
    pub scopes: Vec<String>,
    pub exp: usize,
    pub iss: String,
    pub aud: String,
}

pub fn validate_token(token: &str) -> Result<TokenData<Claims>, jsonwebtoken::errors::Error> {
    let mut validation = Validation::new(Algorithm::RS256);
    validation.validate_exp = true;
    validation.validate_nbf = true;
    validation.set_audience(&["rocket-api.example.com"]);
    validation.issuer = &["https://auth.example.com"];
    validation.required_spec_claims.insert("scope".to_string());

    decode::

use jsonwebtoken::{encode, Header, EncodingKey};
use serde::{Serialize, Deserialize};

#[derive(Debug, Serialize, Deserialize)]
pub struct ClaimsShort {
    pub sub: String,
    pub scope: String,
    pub exp: usize,
    pub iss: String,
    pub aud: String,
    pub c_nf: Option<String>, // "cnf" claim for token binding
}

pub fn issue_token(subject: &str, scope: &str, binding_value: Option&lt;&str&gt;) -> String {
    let expiration = chrono::Utc::now()
        .checked_add_signed(chrono::Duration::minutes(15))
        .expect("valid timestamp")
        .timestamp() as usize;

    let claims = ClaimsShort {
        sub: subject.to_string(),
        scope: scope.to_string(),
        exp: expiration,
        iss: "https://auth.example.com".to_string(),
        aud: "rocket-api.example.com".to_string(),
        c_nf: binding_value.map(|v| v.to_string()),
    };

    encode(
        &Header::new(Algorithm::RS256),
        &claims,
        &EncodingKey::from_rsa_pem(include_bytes!("private_key.pem")).unwrap(),
    ).unwrap()
}

use rocket::State;
use std::sync::Mutex;
use std::collections::HashMap;

struct TokenBucket {
    count: u32,
    last_seen: u64,
}

struct RateLimiter {
    buckets: Mutex<HashMap<String, TokenBucket>>,
}

impl RateLimiter {
    fn new() -> Self {
        RateLimiter {
            buckets: Mutex::new(HashMap::new()),
        }
    }

    fn allow(&self, token_subject: &str) -> bool {
        let now = std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .unwrap()
            .as_secs();

        let mut buckets = self.buckets.lock().unwrap();
        let bucket = buckets.entry(token_subject.to_string()).or_insert(TokenBucket { count: 0, last_seen: now });

        if now - bucket.last_seen > 60 {
            bucket.count = 0;
        }
        bucket.last_seen = now;
        bucket.count += 1;

        bucket.count <= 10 // allow up to 10 requests per minute per subject
    }
}

// In a Rocket request guard or fairing:
// let limiter = request.guard::<State<RateLimiter>>().await; // simplified

#[rocket::catch(401)]
fn unauthorized() -> String {
    String::from("Unauthorized")
}

// In request guard, always return the same outcome on failure:
// Outcome::Failure((Status::Unauthorized, ()))