Phishing Api Keys in Actix with Cockroachdb

When an Actix web service stores or references CockroachDB connection details, the typical pattern is to read a database URL from environment variables at startup and then use that URL to create a connection pool. If the Actix configuration accidentally exposes that URL through an endpoint (for example, a debug or health route that prints runtime configuration), an attacker can phish the API key equivalent — the database connection string — and use it to access CockroachDB directly.

In this context, the API key is the CockroachDB connection string, which often contains a username and password (or a cloud service token). Because Actix applications commonly use configuration files or environment variables to supply the database URL, a misconfigured route or overly verbose logging middleware can turn that URL into a data exposure finding. middleBrick scans for such exposures as part of its Data Output check, flagging endpoints that return sensitive information in responses.

An attacker who obtains the CockroachDB connection string can connect to the database using native PostgreSQL-compatible clients (for example, cockroach sql or psql) and execute SQL commands. This maps to common OWASP API Top 10 risks such as Broken Object Level Authorization (BOLA) when the compromised credentials allow access to tenant-specific data, and it can lead to sensitive data exposure or manipulation if the database contains production records.

middleBrick detects these risks by testing unauthenticated endpoints and analyzing OpenAPI specifications alongside runtime behavior. For Actix services that integrate CockroachDB, the scanner checks whether responses inadvertently include database identifiers or connection details and maps findings to compliance frameworks like PCI-DSS and SOC2.

Remediation focuses on ensuring that CockroachDB connection strings never appear in HTTP responses, logs, or error messages, and on using secure configuration patterns in Actix.

1. Avoid exposing configuration in handlers

Do not implement handlers that return server or database configuration. If you need a health check, return only operational status.

use actix_web::{web, HttpResponse, Responder};

// Good: health endpoint that does not expose configuration
async fn health() -> impl Responder {
    HttpResponse::Ok().json(serde_json::json!({ "status": "ok" }))
}

// Bad: an endpoint that echoes configuration — remove or protect it
// async fn debug_config() -> impl Responder {
//     let database_url = std::env::var("DATABASE_URL").unwrap_or_default();
//     HttpResponse::Ok().body(database_url)
// }

2. Load configuration securely at startup

Read the CockroachDB URL from environment variables during application initialization and store it in a secure, non-exportable structure. Do not log the full URL.

use actix_web::web::Data;
use std::env;

struct AppState {
    db_url: String,
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    let database_url = env::var("DATABASE_URL").expect("DATABASE_URL must be set");
    // Do not log database_url here in production
    let state = Data::new(AppState { db_url: database_url });
    actix_web::HttpServer::new(move || {
        actix_web::App::new()
            .app_data(state.clone())
            .route("/health", actix_web::web::get().to(health))
    })
    .bind("127.0.0.1:8080")?
    .run()
    .await
}

3. Use CockroachDB secure connection parameters

When connecting to CockroachDB from Actix via a PostgreSQL driver (for example, bb8 with postgres), prefer connection parameters that avoid embedding credentials in the URL, or ensure the URL is stored securely.

// Example using bb8-postgres with a connection string
// Prefer environment variables and runtime injection over hardcoded values
use bb8_postgres::PostgresConnectionManager;
use tokio_postgres::NoTls;
use std::env;

let database_url = env::var("DATABASE_URL").expect("DATABASE_URL must be set");
let config = database_url.parse().expect("valid connection string");
let mgr = PostgresConnectionManager::new(config, NoTls);
let pool = bb8::Pool::builder().build(mgr).await.expect("pool build");

4. Rotate credentials and avoid debug endpoints in production

Ensure that CockroachDB usernames and passwords (or cloud service tokens) are rotated regularly. In Actix, remove any development endpoints that print configuration before deploying to production. middleBrick’s Continuous Monitoring (Pro plan) can be configured to alert you if a configuration-exposing pattern appears in new commits or deployed endpoints.

5. Map findings to compliance and enforce in CI/CD

Use the GitHub Action to fail builds when a scan detects data exposure or authentication weaknesses. This prevents deployment of code that could leak CockroachDB connection strings.

# .github/workflows/api-security.yml
name: API Security
on: [push]
jobs:
  middlebrick:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run middleBrick
        uses: middlebrick/github-action@v1
        with:
          url: 'https://your-actix-service.example.com'
          fail-below: 'C'
          token: ${{ secrets.MIDDLEBRICK_TOKEN }}