Dns Cache Poisoning in Actix with Bearer Tokens

DNS Cache Poisoning can affect Actix-based services that perform secondary network calls during request processing, such as resolving service discovery names or external APIs. When an Actix application uses bearer tokens obtained from an upstream identity provider, those tokens are often included in outbound HTTP requests. If an attacker can poison the DNS cache of the environment where Actix resolves these upstream hosts, the application may be directed to a malicious server that the attacker controls.

In this scenario, the attacker does not need to compromise the Actix service itself. Instead, they manipulate DNS responses to redirect a trusted hostname (for example, auth.example.com or api.partner.com) to an IP they control. The Actix service, using standard HTTP client behavior, continues to send bearer tokens and sensitive requests to the now-compromised endpoint. Because bearer tokens are high-privilege credentials, this can lead to unauthorized access, token exfiltration, or downstream privilege escalation across integrated systems.

The interaction with bearer tokens is critical: the token is typically included in the Authorization header (Authorization: Bearer ). If the resolution infrastructure is poisoned, the token is sent to an attacker, who can then replay it against the legitimate service. This is especially dangerous when token introspection or revocation is not performed on each request, or when short-lived tokens are accepted as sufficient without additional context checks.

Actix does not provide built-in DNS-level protections in its default HTTP client configuration. Developers must ensure that the HTTP client used in Actix enforces strict hostname verification, uses a secure DNS resolver, or pins expected endpoints. Without these measures, the application remains vulnerable to indirect compromise via DNS Cache Poisoning, even when the application itself is otherwise hardened.

Remediation focuses on ensuring that bearer tokens are only sent to verified, trusted endpoints and that DNS resolution cannot be hijacked to redirect those requests. Below are concrete practices and code examples for Actix-based Rust services.

1. Use a pinned HTTP client with strict DNS settings

Configure your HTTP client to use a resolver that does not rely on mutable system caches. For example, using reqwest with a custom trust-dns-resolver ensures predictable resolution:

use reqwest::Client;
use std::time::Duration;

let client = Client::builder()
    .timeout(Duration::from_secs(10))
    .build()
    .expect("Failed to build HTTP client");
// Ensure the client uses a secure resolver in production by configuring
// trust-dns-resolver or using system DNS with validation where possible.

2. Validate the target host before sending bearer tokens

Before attaching a bearer token to a request, confirm that the hostname matches an expected allowlist or certificate subject. This prevents sending credentials to a poisoned or unexpected IP:

use reqwest::header::{AUTHORIZATION, HeaderValue};
use url::Url;

fn prepare_request(url: &str, token: &str) -> Result<reqwest::Request, &'static str> {
    let parsed = Url::parse(url).map_err(|_| "Invalid URL")?;
    let host = parsed.host_str().ok_or("Missing host")?;
    // Example allowlist check
    let allowed = ["auth.example.com", "api.partner.com"];
    if !allowed.contains(&host) {
        return Err("Host not allowed");
    }
    let token_value = HeaderValue::from_str(&format!("Bearer {}", token)).map_err(|_| "Invalid token")?;
    let request = reqwest::Request::new(reqwest::Method::GET, parsed);
    request.headers_mut().insert(AUTHORIZATION, token_value);
    Ok(request)
}

3. Enforce certificate and hostname verification

Ensure your HTTP client validates server certificates and matches them against the expected hostname. With reqwest (which uses native-tls or rustls), this is enabled by default, but verify that no custom configuration disables it:

let client = reqwest::Client::builder()
    .use_rustls_tls()
    .danger_accept_invalid_certs(false)
    .build()?;

4. Avoid environment variables or config for dynamic host resolution of bearer-token endpoints

Do not construct bearer-token request URLs from environment variables that can be influenced at runtime. Instead, hardcode or securely inject trusted endpoints and use runtime checks as shown above.

5. Monitor and rotate bearer tokens

Incorporate short lifetimes for bearer tokens and use refresh mechanisms that re-validate the destination host. Even if DNS is poisoned, rotated tokens reduce the window of usefulness for exfiltrated credentials.