Cryptographic Failures in Rocket with Basic Auth

Using HTTP Basic Authentication in a Rocket service without TLS creates a direct cryptographic failure: credentials are base64-encoded but not encrypted, making them trivially recoverable to anyone who can observe the traffic. Base64 is easily reversible, so intercepted Authorization headers reveal usernames and passwords. This maps to the OWASP API Top 10 category Cryptographic Failures and commonly appears as a finding in unauthenticated scans where TLS is not enforced.

Even when TLS is used, implementation issues can reintroduce risk. For example, accepting requests on both HTTP and HTTP redirects to HTTPS can expose credentials in cleartext during the redirect. Additionally, logging headers indiscriminately may cause Authorization values to be stored in application or server logs, creating long-term data exposure. Because Basic Auth sends credentials with every request, any weak link in the chain—missing HSTS, weak cipher suites, or mixed content—amplifies the impact. A scanner that inspects the unauthenticated attack surface can detect whether TLS is required and whether sensitive headers appear in logs, highlighting these cryptographic failures.

In the context of an OpenAPI/Swagger spec analysis, a security check can identify whether securitySchemes of type http with scheme basic are defined without an associated requirement for HTTPS. If the spec describes a security scheme that relies on Basic Auth but does not enforce transport-layer protections, runtime findings may flag insecure transmission and missing encryption. This combination of a weak authentication mechanism and inadequate cryptographic controls increases the likelihood of credential compromise and falls under the broader issue of Data Exposure.

Remediation focuses on enforcing HTTPS and avoiding the use of Basic Auth where stronger mechanisms are feasible. If you must use Basic Auth, ensure it is only transmitted over TLS and never logged. Below are concrete Rocket examples that demonstrate secure configuration and header handling.

Enforce HTTPS and reject HTTP

Configure Rocket to only accept HTTPS requests and enable strict transport security. This prevents credentials from being sent in cleartext and protects against downgrade attacks.

use rocket::config::{Config, TlsConfig};

#[rocket::main]
async fn main() {
    let tls = TlsConfig::new()
        .cert("path/to/cert.pem")
        .key("path/to/key.pem")
        .expect("TLS configuration is valid");
    let config = Config::build(rocket::Config::default())
        .tls(tls)
        .finalize()
        .expect("Valid configuration");
    rocket::custom(config).mount("/", routes![health])
        .launch()
        .await
        .expect("Rocket launches with HTTPS only");
}

#[get("/health")]
fn health() -> &'static str {
    "ok"
}

Require secure connections and reject cleartext

Use Rocket’s request guards to reject non-TLS requests. This ensures that any attempt to connect over HTTP is dropped before authentication headers are processed.

use rocket::request::{self, Request};
use rocket::{Outcome, RequestGuard};

struct Secure; // marker type

impl<'r> request::FromRequest<'r> for Secure {
    type Error = ();

    fn from_request(request: &'r Request<'_>) -> request::Outcome<Secure, Self::Error> {
        if request.tls().is_some() {
            Outcome::Success(Secure)
        } else {
            Outcome::Failure((&quot;TLS required&quot;, ()))
        }
    }
}

#[get("/api/data")]
fn secure_endpoint(_secure: Secure) -> &'static str {
    "secure data"
}

Avoid logging sensitive headers

Customize logging to exclude the Authorization header. This prevents credentials from being persisted in logs.

use rocket::fairing::AdHoc;

fn no_auth_logging() -> AdHoc {
    AdHoc::on_response(
        "No-Auth-Logging",
        |_fairing, _request, response| {
            // In a real setup, integrate with a logging guard or filter
            // that scrubs Authorization headers before they are written.
        },
    )
}

fn rocket() -> rocket::Rocket<rocket::Build> {
    rocket::build()
        .attach(no_auth_logging())
        .mount("/", routes![health])
}

Prefer stronger authentication

Where possible, replace Basic Auth with form-based or token-based mechanisms that do not expose credentials in every request. If Basic Auth is necessary, combine it with additional protections such as mutual TLS or short-lived credentials rotated frequently.