Request Smuggling in Axum with Jwt Tokens

Request smuggling is an HTTP protocol violation where an attacker can cause one request to be interpreted differently by separate servers or layers (e.g., frontend proxy vs. backend). In Axum, when JWT tokens are used for authentication, smuggling can expose authorization bypass or account takeover if header parsing is inconsistent between layers.

Axum applications often rely on middleware to extract and validate JWT tokens from headers such as Authorization: Bearer <token> or custom headers like x-api-key. If the application or a reverse proxy normalizes or parses headers differently, an attacker can craft requests that exploit discrepancies in how header fields are split or interpreted. Common smuggling techniques include using ambiguous header line endings, duplicate headers, or inconsistent handling of Transfer-Encoding and Content-Length. When JWT tokens are involved, smuggling can allow an attacker to inject a second request that bypasses authentication checks, because the backend may parse the token header as part of the next request.

For example, a proxy might terminate TLS and forward requests to Axum with modified headers. If the proxy normalizes Authorization but Axum does not, a crafted request can cause the token to be associated with the wrong downstream request. This can lead to privilege escalation if an admin’s token is interpreted as belonging to a lower-privilege user, or enable access to unauthenticated endpoints if the token is dropped or ignored. The vulnerability is not in JWT validation itself, but in how headers are handled before validation occurs.

In a black-box scan, middleBrick tests for such inconsistencies by sending requests with ambiguous or duplicate headers while monitoring for unauthorized access or response anomalies. For JWT-based APIs, this includes verifying that tokens are consistently required and validated on all protected routes. Without proper header canonicalization and strict parsing rules, Axum applications remain exposed to smuggling attacks that compromise the security provided by JWT tokens.

Remediation focuses on ensuring consistent header parsing, strict validation, and defensive middleware design in Axum. The following examples demonstrate secure handling of JWT tokens to mitigate request smuggling risks.

1. Enforce strict header parsing and reject ambiguous requests

Use Axum middleware to reject requests with duplicate or malformed headers before JWT validation occurs. This prevents smuggling attempts that rely on inconsistent header interpretation.

use axum::{http::request::Parts, middleware::Next, response::Response, Json};
use std::convert::Infallible;

async fn reject_ambiguous_headers(
    mut parts: Parts,
    next: Next,
) -> Result {
    // Reject requests with duplicate headers that could enable smuggling
    let headers = &parts.headers;
    if headers.duplicate_count(&http::header::AUTHORIZATION) > 1 {
        return Err((axum::http::StatusCode::BAD_REQUEST, "Duplicate Authorization header".into()));
    }
    if headers.duplicate_count(&http::header::CONTENT_LENGTH) > 1
        || headers.duplicate_count(&http::header::TRANSFER_ENCODING) > 1
    {
        return Err((axum::http::StatusCode::BAD_REQUEST, "Duplicate transfer headers".into()));
    }
    next.run(parts).await
}

2. Normalize headers before JWT validation

Ensure the JWT extraction logic uses canonical header names and rejects mixed-case or whitespace-variant headers that could confuse downstream proxies.

use axum::extract::State;
use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation};

async fn validate_jwt(
    State(secrets): State<AppState>,
    headers: axum::http::HeaderMap,
) -> Result<Claims, (axum::http::StatusCode, String)> {
    // Use exact byte-for-byte header name to avoid smuggling via case variations
    let auth_header = headers.get(b"authorization")
        .ok_or((axum::http::StatusCode::UNAUTHORIZED, "Missing authorization header".into()))?;
    let token = auth_header.to_str().map_err(|_| (axum::http::StatusCode::BAD_REQUEST, "Invalid header encoding".into()))?;
    let token = token.strip_prefix("Bearer ").ok_or((axum::http::StatusCode::UNAUTHORIZED, "Invalid bearer format".into()))?;

    let validation = Validation::new(Algorithm::HS256);
    let token_data = decode::<Claims>(token, &DecodingKey::from_secret(secrets.jwt_secret.as_ref()), &validation)
        .map_err(|_| (axum::http::StatusCode::UNAUTHORIZED, "Invalid token".into()))?;
    Ok(token_data.claims)
}

3. Use typed extractor and reject requests without required headers

Leverage Axum extractors to enforce that JWT tokens are present and correctly formatted, reducing the surface for header manipulation.

use axum::async_trait;

struct JwtToken(String);

#[async_trait]
impl<T> FromRequest<T> for JwtToken 
where
    State<T>: Send + Sync + 'static,
    T: Send + Sync,
{
    type Rejection = (axum::http::StatusCode, String);

    async fn from_request(req: <axum::http::Request<Body> as FromRequestParts<T>::Parts) -> Result<Self, Self::Rejection> {
        let headers = req.headers();
        let auth = headers.get(http::header::AUTHORIZATION)
            .ok_or((axum::http::StatusCode::UNAUTHORIZED, "Missing Authorization".into()))?;
        let token = auth.to_str().map_err(|_| (axum::http::StatusCode::BAD_REQUEST, "Invalid header".into()))?;
        if !token.starts_with("Bearer ") {
            return Err((axum::http::StatusCode::UNAUTHORIZED, "Bearer token required".into()));
        }
        Ok(JwtToken(token[7..].to_string()))
    }
}

4. Apply middleware globally and prioritize it before routing

Register the duplicate header rejection middleware at the top of your application stack to ensure all incoming requests are sanitized before reaching JWT validation or business logic.

use axum::Router;

let app = Router::new()
    .layer(middleware::from_fn(reject_ambiguous_headers))
    .route("/secure", post(validate_jwt_handler));

5. Align proxy and application header handling

Ensure your reverse proxy (e.g., Nginx, Cloudflare) does not strip or reorder headers in a way that diverges from Axum’s expectations. Configure the proxy to pass headers verbatim and avoid merging or removing duplicates unless explicitly required.