Regex Dos in Axum with Api Keys

To mitigate Regexp Dos in Axum when handling API keys, prefer bounded, non-overlapping patterns and avoid nested quantifiers. Use explicit length limits and atomic groups where supported, and validate key structure before applying regex. Below are concrete, safe patterns and extractor implementations.

Safe regex patterns for API keys:

• Use non-overlapping, bounded quantifiers: [a-zA-Z0-9_-]{20,64} instead of nested repeats like ([a-zA-Z0-9_-]{5,})+.
• Avoid ambiguous alternation that can cause exponential exploration; prefer explicit character classes and fixed-length segments.
• Pre-compile regex with regex::Regex::builder() to set size limits and enable optimizations.

Example: bounded extractor with safe regex:

use axum::extract::FromRequest;
use http::{Request, StatusCode};
use regex::Regex;
use std::{future::Future, pin::Pin, sync::Arc};

#[derive(Debug, Clone)]
struct SafeApiKeyValidator {
    pattern: Regex,
}

impl SafeApiKeyValidator {
    fn new() -> Self {
        // Bounded pattern, no nested quantifiers, no overlapping alternatives
        let pattern = Regex::new(r"^[a-zA-Z0-9_-]{20,64}$").expect("valid regex");
        Self { pattern }
    }

    fn validate(&self, key: &str) -> bool {
        self.pattern.is_match(key)
    }
}

#[derive(Debug, Clone)]
struct ApiKey(String);

impl FromRequest for ApiKey {
    type Extension = Arc;
    type Rejection = (StatusCode, String);
    type Future = Pin<Box<dyn Future<Output = Result<Self, Self::Rejection> + Send + 'static>>>;

    fn from_request(req: &Request<()>, ext: &Self::Extension) -> Self::Future {
        let header_value = req.headers().get("X-API-KEY")
            .and_then(|v| v.to_str().ok())
            .unwrap_or("");
        if ext.validate(header_value) {
            let key = ApiKey(header_value.to_string());
            Box::pin(async move { Ok(key) })
        } else {
            let err = (StatusCode::UNAUTHORIZED, "Invalid API key".to_string());
            Box::pin(async move { Err(err) })
        }
    }
}

// In your router setup:
// let validator = Arc::new(SafeApiKeyValidator::new());
// let app = Router::new()
//     .layer(Extension(validator))
//     .route("/items", get(handler));

Additional hardening steps:

• Reject keys with known risky prefixes or suffixes (e.g., sequences that resemble regex meta-characters).
• Rate-limit validation attempts per source IP to reduce abuse potential.
• Use constant-time comparison when checking key equality after regex validation to avoid timing side channels.

middleBrick’s Pro plan supports continuous monitoring and CI/CD integration (e.g., GitHub Action) to enforce security thresholds and fail builds on risky patterns, helping teams catch ReDoS and related issues before deployment. Its findings map to compliance frameworks such as PCI-DSS and SOC2, providing remediation guidance rather than attempting to fix or block traffic directly.