Http Request Smuggling in Axum with Api Keys

Http Request Smuggling (HRS) is an OWASP API Top 10 risk that arises when an API processes requests differently depending on whether a frontend proxy and a backend server interpret message boundaries in conflicting ways. In Axum, this can occur when custom routing or middleware logic does not enforce strict message framing and when authorization via Api Keys is applied inconsistently across layers.

Consider a setup where an API Gateway or load balancer terminates TLS and forwards requests to an Axum service. If the gateway normalizes or buffers requests differently than Axum parses them—such as handling Transfer-Encoding and Content-Length headers inconsistently—an attacker can craft a request that is interpreted as two separate requests by the two layers. One request may be authenticated and authorized using an Api Key, while the other is not, allowing the attacker to smuggle a request into the backend that bypasses intended access controls.

When Api Keys are validated in Axum via middleware that reads headers before routing, but the smuggling layer splits or reorders headers, the key may be consumed by one request and not the other. For example, an attacker might send a request with both Transfer-Encoding: chunked and Content-Length headers. The frontend may treat the request as a single batched message, while Axum parses it as separate requests. The first request, which includes a valid Api Key, may be processed normally, while the second request, lacking proper authorization, is interpreted as unauthenticated and routed to a less-protected endpoint.

This becomes particularly dangerous when Axum routes are not uniformly protected. Suppose some routes validate Api Keys in middleware and others do not, or when routes are conditionally composed based on feature flags. An attacker can exploit these inconsistencies by smuggling a request to an unguarded route, leveraging the authorized context established by the first smuggled request. The result is privilege escalation or unauthorized data access, even though each individual request appears to carry a valid Api Key.

Because middleBrick scans the unauthenticated attack surface, it can detect inconsistencies in how headers and routing are handled. In reports, findings may reference patterns such as inconsistent Content-Length handling or missing strict header validation in Axum middleware. These findings map to OWASP API Top 10 A01:2023 Broken Object Level Authorization and A05:2023 Security Misconfiguration, and align with known CVE patterns involving request splitting and authorization bypass.

To mitigate Http Request Smuggling risks in Axum when using Api Keys, ensure that header parsing, routing, and authorization are consistent and defensive. The following code examples show how to implement robust Api Key validation and header normalization within an Axum application.

First, normalize incoming headers before routing. Strip or reject ambiguous Transfer-Encoding and Content-Length combinations at the edge or within Axum middleware to prevent parsing discrepancies between layers.

use axum::{routing::get, Router, extract::RequestParts, async_trait};
use std::convert::Infallible;
use headers::{Authorization, authorization::Bearer, HeaderMapExt};

async fn validate_api_key(req: &mut RequestParts) -> Result<(), Infallible> {
    // Normalize: reject requests with both TE and Content-Length
    let headers = req.headers();
    let has_te = headers.get("transfer-encoding").is_some();
    let has_cl = headers.get("content-length").is_some();
    if has_te && has_cl {
        *req.extensions_mut() = Default::default();
        return Err(Infallible);
    }

    // Validate Api Key in a dedicated header
    let api_key = headers.get("X-API-Key")
        .and_then(|v| v.to_str().ok())
        .filter(|v| !v.is_empty());
    match api_key {
        Some(key) if key == std::env::var("EXPECTED_API_KEY").unwrap_or_default() => Ok(()),
        _ => Err(Infallible),
    }
}

pub fn app() -> Router {
    Router::new()
        .route("/public", get(|| async { "public" }))
        .route("/secure", get(secure_endpoint))
        .layer(axum::middleware::from_fn(|req, next| async move {
            validate_api_key(&mut req).await?;
            Ok(next.run(req).await)
        }))
}

Second, ensure that authorization is applied after routing and not reused across request boundaries. Avoid applying Api Key checks at a high-level router and then conditionally composing routes that skip validation.

use axum::extract::State;
use std::sync::Arc;

struct AppState {
    expected_key: String,
}

async fn secure_endpoint(
    State(state): State>,
    mut req: RequestParts,
) -> Result {
    let api_key = req.headers()
        .get("X-API-Key")
        .and_then(|v| v.to_str().ok())
        .filter(|v| v == &&state.expected_key[..]);
    if api_key.is_none() {
        return Err(Infallible);
    }
    Ok("secure data".to_string())
}

// In main, build state and routes without duplicating checks
let state = Arc::new(AppState { expected_key: std::env::var("EXPECTED_API_KEY").unwrap() });
let app = Router::new()
    .route("/secure", get(secure_endpoint))
    .with_state(state);

Third, avoid ambiguous header interpretations by explicitly handling or rejecting chunked transfer encodings at the edge. If your deployment includes a gateway that buffers requests differently, configure it to forward messages with a single, canonical framing mode and ensure Axum never sees a request where Content-Length and Transfer-Encoding are both present.

Finally, use middleBrick to continuously scan your Axum endpoints. The CLI tool allows you to integrate scans into scripts, while the GitHub Action can fail builds if risk scores degrade. The MCP Server enables scanning directly from AI coding assistants, helping you detect misconfigurations before deployment.