Cross Site Request Forgery in Actix with Basic Auth

Cross Site Request Forgery (CSRF) in Actix applications that rely exclusively on HTTP Basic Authentication can be particularly dangerous because the authentication credentials are transmitted with each request and can be inadvertently exposed or reused in cross-origin contexts. Unlike cookie-based sessions, Basic Auth does not have built-in browser protections such as SameSite attributes, and developers may mistakenly assume that because credentials are sent only over HTTPS, the application is protected against CSRF. This is not the case: once an authenticated user visits a malicious site, an attacker can craft requests that the browser automatically sends with the Authorization header if the request method and content type are simple and the endpoint does not enforce explicit anti-CSRF controls.

In Actix, when Basic Auth is used without additional synchronization tokens or custom headers to distinguish legitimate requests, an attacker can construct a form or script on a different origin that performs state-changing operations on behalf of the authenticated user. For example, an endpoint like POST /api/transfer that relies on the presence of Authorization: Basic base64(credentials) will execute if the browser automatically includes that header. Because Basic Auth credentials are long-lived until revoked, the risk persists across sessions unless the user explicitly logs out or changes credentials. This combination of a static credential mechanism and missing origin checks means that any endpoint that changes server state is potentially vulnerable if it does not validate the request origin or require a secondary token.

Consider an Actix web service that exposes an OpenAPI 3.0 spec with a path /api/account/update-email that accepts JSON and uses Basic Auth. If the spec does not indicate the need for an anti-CSRF token and the runtime implementation does not check the Origin or Referer headers, an attacker can host a page that submits a forged request. Even if the API is not intended for browser-based consumption, an authenticated user who has the credentials cached in the browser may still be at risk if those credentials are transmitted automatically. Tools like middleBrick can detect such issues by scanning the unauthenticated attack surface, analyzing the OpenAPI/Swagger spec (including $ref resolution), and correlating missing security schemes with state-changing methods to highlight CSRF-prone endpoints.

It is important to note that middleware or guards in Actix that only verify the presence of Basic Auth are insufficient to prevent CSRF. Attackers can exploit simple request methods (GET, HEAD, OPTIONS, TRACE) in unsafe combinations or leverage mixed content scenarios to leak authorization headers. Defenses must be explicit: require custom request headers that cannot be set cross-origin, validate the request origin against an allowlist, or use synchronizer tokens for state-changing operations. middleBrick’s 12 parallel security checks, including Authentication and BOLA/IDOR, can surface these gaps by comparing expected authentication schemes with actual runtime behavior, providing prioritized findings and remediation guidance.

Real-world examples include APIs that accept JSON payloads without anti-CSRF headers and lack CORS restrictions that would prevent unauthorized origins from making authenticated requests. By instrumenting Actix routes with explicit header checks and integrating continuous scanning from tools like middleBrick, teams can detect missing CSRF protections before attackers exploit them. The scanner does not fix the code, but it provides detailed guidance on how to adjust route guards, validate origins, and structure authentication flows to reduce the risk of unauthorized state changes.

To remediate CSRF when using Basic Auth in Actix, you should combine explicit origin validation, custom request headers, and where appropriate, anti-CSRF tokens. Basic Auth itself cannot be used as the sole defense against CSRF because browsers will automatically include the Authorization header on same-origin and some cross-origin requests when credentials are embedded in the URL or cached. The following patterns demonstrate concrete fixes you can apply in an Actix service.

First, validate the Origin or Referer header on sensitive routes. This is not foolproof due to header stripping in some environments, but it raises the bar significantly. In Actix, you can implement a guard that inspects these headers before allowing the request to proceed.

use actix_web::{web, HttpRequest, Error};

fn validate_origin(req: &HttpRequest, allowed_origin: &str) -> Result<(), Error> {
    match req.headers().get("Origin") {
        Some(origin) => {
            if origin.to_str().unwrap_or("") == allowed_origin {
                Ok(())
            } else {
                Err(actix_web::error::ErrorForbidden("Invalid origin"))
            }
        }
        None => Err(actix_web::error::ErrorForbidden("Missing origin")),
    }
}

Second, require a custom header such as X-Requested-With or a framework-specific anti-CSRF token for state-changing methods. Because cross-origin sites cannot set custom headers without CORS preflight approval, this effectively blocks forged requests from malicious origins.

use actix_web::{web, HttpRequest, Error, HttpResponse};

fn validate_custom_header(req: &HttpRequest) -> Result<(), Error> {
    match req.headers().get("X-Requested-With") {
        Some(val) if val == "XMLHttpRequest" => Ok(()),
        _ => Err(actix_web::error::ErrorForbidden("Missing or invalid custom header")),
    }
}

Third, when possible, avoid relying on Basic Auth for browser-facing endpoints and instead use session-based authentication with secure, SameSite cookies. If you must keep Basic Auth, ensure that the endpoint does not accept unsafe methods without additional checks, and enforce strict CORS policies that do not allow arbitrary origins.

Finally, integrate middleBrick into your workflow to continuously verify that your mitigations are effective. Use the CLI to scan from terminal with commands like middlebrick scan <url>, add API security checks to your CI/CD pipeline with the GitHub Action to fail builds if risk scores drop below your threshold, or scan APIs directly from your AI coding assistant using the MCP Server. These integrations help you detect missing CSRF protections and other misconfigurations early, but remember that middleBrick detects and reports only; it does not modify code or block requests.