Dns Rebinding in Actix with Jwt Tokens

DNS Rebinding is a client-side attack where an attacker tricks a victim’s browser into resolving a domain to an internal IP address that is not normally reachable from the public internet. In an Actix web service that uses JWT tokens for authentication, this combination can bypass authorization boundaries when tokens are handled naively and the application logic trusts host-based controls or origin checks.

Consider an Actix web application that validates a JWT token on each request but then uses the HTTP Host header or a client-supplied origin value to make authorization decisions, such as allowing access to admin endpoints or sensitive resources. During a DNS Rebinding attack, a malicious page causes the browser to send requests to the Actix server over time, changing the resolved IP address (for example, first resolving to a public address that passes network-based allowlists, then rebinding to an internal address like 127.0.0.1). If the Actix application uses the Host header to determine tenant context or to construct URLs, and if JWT validation does not strictly enforce token binding to the expected audience and issuer, an attacker may be able to reuse a valid token issued for a public context to access internal services or administrative routes that the server exposes conditionally based on network location.

Another scenario involves token leakage via Referer headers when the Actix application serves mixed content or redirects. A victim’s browser may include Authorization headers containing the JWT when making subsequent requests to rebinding endpoints, and if those endpoints do not enforce strict CORS and origin checks, the token can be exposed or used in a chained attack. Because Actix routes are often defined with path and method matchers, an attacker can probe for weak route-level authorization that relies on IP-based allowlists rather than token claims. This is especially risky when the application uses JWT tokens with broad scopes or missing nonce checks, enabling privilege escalation across users or interfaces that the token was not intended to access.

To illustrate, a vulnerable Actix route might inspect the Host header to decide whether to allow an administrative operation, while only verifying that a JWT is present but not whether its claims constrain access to that specific host or network zone. An attacker can use DNS Rebinding to make the server believe the request originates from a trusted internal network, bypassing intended network segmentation. Even with JWT validation in place, if the server does not bind token validity to the request’s effective target origin and does not validate the token’s registered claims against the request context, the attack can lead to unauthorized data exposure or management interfaces being reached.

Remediation centers on strict JWT validation, avoiding reliance on mutable request metadata such as Host or Origin, and enforcing token binding to the intended audience and issuer. In Actix, this means using robust extractor and validation logic rather than header-based or path-based authorization shortcuts.

Below is a concrete example of secure JWT validation in Actix using the jsonwebtoken crate. The code defines a claims structure, a validation helper, and a guard that ensures the token is correctly verified before allowing access to protected routes.

use actix_web::{dev::ServiceRequest, Error, HttpMessage};
use actix_web_httpauth::extractors::bearer::BearerAuth;
use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation, TokenData};
use serde::{Deserialize, Serialize};

#[derive(Debug, Serialize, Deserialize)]
struct Claims {
    sub: String,
    aud: String,
    iss: String,
    exp: usize,
    nbf: usize,
    #[serde(rename = "type")]
    token_type: String,
}

async fn validate_jwt(auth: BearerAuth) -> Result<TokenData<Claims>, Error> {
    let token = auth.token();
    let validation = Validation::new(Algorithm::HS256);
    let token_data = decode:: Result {
    let token_data = validate_jwt(req.headers().get("Authorization")?.to_str()?.into()).await?;
    // Proceed only if token is valid and claims are as expected
    Ok(actix_web::HttpResponse::Ok().finish())
}

To further mitigate DNS Rebinding risks, avoid using the Host header for tenant or route resolution. Instead, derive routing and authorization strictly from validated JWT claims such as aud and scope. Ensure that CORS policies are strict, rejecting requests with an Origin that does not exactly match the expected domain. Do not allow credentials to be included in cross-origin requests unless necessary, and configure Actix middleware to reject requests where the Host header does not match a predefined set of allowed values.

For continuous protection, integrate middleBrick into your development workflow. Use the CLI to scan your Actix endpoints from the terminal with middlebrick scan <url>, or add the GitHub Action to your CI/CD pipeline to fail builds if security scores drop below your chosen threshold. These integrations help catch misconfigurations that could otherwise be exploited through techniques like DNS Rebinding combined with weak JWT usage.