Insecure Direct Object Reference in Axum with Basic Auth

Remediation focuses on ensuring that every access to a resource validates both the authentication context and the ownership or authorization relationship between the authenticated subject and the requested object. In Axum, this typically means inspecting the authenticated identity from Basic Auth and comparing it explicitly with the resource’s owning identifier before returning or modifying data.

Below are concrete Axum handler examples that demonstrate secure patterns. The first example shows how to parse Basic Auth credentials, extract the username, and enforce that the requested user ID matches the authenticated username.

use axum::{
    async_trait, body::Body, extract::FromRequest, http::{request::Parts, StatusCode},
    response::IntoResponse, routing::get, Router,
};
use base64::Engine;
use serde::Serialize;
use std::net::SocketAddr;

#[derive(Serialize)]
struct UserProfile {
    id: u64,
    username: String,
    email: String,
}

// A simple in-memory store for demonstration.
struct UserStore;
impl UserStore {
    async fn get_by_id(&self, id: u64) -> Option {
        // Replace with real database lookup.
        Some(UserProfile { id, username: format!("user{}", id), email: format!("user{}@example.com", id) })
    }
    async fn get_by_username(&self, username: &str) -> Option {
        // Replace with real database lookup.
        if username.starts_with("user") {
            let id = username.trim_start_matches("user").parse::().ok()?;
            self.get_by_id(id).ok()
        } else {
            None
        }
    }
}

async fn basic_auth_user(request: &Parts) -> Option {
    let header_value = request.headers.get("authorization")?;
    let header_str = header_value.to_str().ok()?;
    if let Some(credentials) = header_str.strip_prefix("Basic ") {
        let decoded = base64::engine::general_purpose::STANDARD.decode(credentials).ok()?;
        let decoded_str = String::from_utf8(decoded).ok()?;
        let mut parts = decoded_str.split(':');
        let user = parts.next()?;
        // We ignore password for ownership checks; password validation can be added separately.
        return Some(user.to_string());
    }
    None
}

async fn get_user_profile_handler(
    store: axum::extract::State,
    axum::extract::Path(user_id): axum::extract::Path,
    request: axum::extract::Request,
) -> impl IntoResponse {
    let user = match basic_auth_user(request.headers()).await {
        Some(username) => store.get_by_username(&username).await,
        None => None,
    };

    match user {
        Some(profile) if profile.id == user_id => (StatusCode::OK, axum::Json(profile)),
        _ => (StatusCode::FORBIDDEN, "Access denied: insufficient permissions".into()),
    }
}

#[tokio::main]
async fn main() {
    let store = UserStore;
    let app = Router::new()
        .route("/users/:user_id", get(get_user_profile_handler))
        .with_state(store);

    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));
    axum::Server::bind(&addr)
        .serve(app.into_make_service())
        .await
        .unwrap();
}

This handler retrieves the username from the Basic Auth header and looks up the profile by username, then explicitly checks that the profile’s ID matches the path parameter user_id. If they do not match, it returns a 403 Forbidden response, ensuring that users cannot access other users’ resources simply by changing the path ID.

For scenarios where usernames are not used as identifiers, you can map authenticated identity to a stable user key (such as a database primary key) and perform a join or permission check before serving data. The essential principle is to treat object references as untrusted input and always verify the relationship between the authenticated subject and the referenced resource on each request.

middleBrick’s scans validate these authorization boundaries by probing endpoints with different object references while preserving the same authenticated context. If your Axum service passes Basic Auth but still leaks data across references, remediation should enforce strict ownership checks and avoid exposing internal IDs in predictable forms.