Heartbleed in Axum with Api Keys

Heartbleed (CVE-2014-0160) is a vulnerability in OpenSSL that allows reading memory from the server process. When Axum services are configured to use Api Keys for authorization, developers may inadvertently rely on the server process to handle sensitive key material in memory. If the Axum runtime or any native library it uses depends on an affected OpenSSL version, Heartbleed can expose Api Keys stored in process memory, including keys loaded from configuration or injected via environment variables.

In Axum, Api Keys are typically validated by inspecting request headers or metadata. During this validation, the key value may be held in application buffers or deserialized into structures that reside in the process memory. A Heartbleed exploit could allow an attacker to read these memory regions, potentially retrieving Api Keys that grant access to protected endpoints. This risk is especially relevant when Axum applications run in environments where OpenSSL versions prior to 1.0.1g are in use and where sensitive credentials are present in process memory at the time of exploitation.

Even though Axum is a Rust web framework and does not directly depend on OpenSSL, its runtime or underlying system libraries might. If Axum services are deployed in containers or hosts that link to vulnerable OpenSSL, any in-memory representation of Api Keys becomes subject to exposure. The scanner checks for signs of unauthenticated endpoints that may leak key material and flags configurations where sensitive data could be read via Heartbleed-style memory disclosure.

To reduce exposure of Api Keys in memory and mitigate risks related to vulnerabilities like Heartbleed, follow these practices when building Axum services. Avoid keeping Api Keys in long-lived process memory and ensure keys are handled securely during validation.

use axum::{
    async_trait,
    extract::FromRequest,
    http::{request::Parts, StatusCode},
};
use std::convert::Infallible;

// Secure Api Key extraction that avoids unnecessary copies and clears sensitive data
pub struct ApiKey(String);

#[async_trait]
impl FromRequest for ApiKey
where
    S: Send + Sync,
{
    type Rejection = (StatusCode, &'static str);

    async fn from_request(req: Parts, _state: &S) -> Result {
        let key = req.headers
            .get("X-API-Key")
            .and_then(|v| v.to_str().ok())
            .filter(|k| !k.is_empty())
            .ok_or((StatusCode::UNAUTHORIZED, "missing or invalid api key"))?;

        // Use a type that can be explicitly cleared
        let mut secret = key.to_string();
        // Validate key format here (e.g., constant-time compare)
        let valid = validate_key(&secret);
        // Clear from stack as soon as possible
        let result = if valid { ApiKey(secret) } else { (StatusCode::UNAUTHORIZED, "invalid api key") };
        secret.clear();
        result
    }
}

fn validate_key(key: &str) -> bool {
    // Use constant-time comparison to avoid timing leaks
    let expected = std::env::var("EXPECTED_API_KEY").unwrap_or_default();
    subtle::ConstantTimeEq::ct_eq(key.as_bytes(), expected.as_bytes()).into()
}