Security Misconfiguration in Axum with Basic Auth

Security misconfiguration in Axum applications that use HTTP Basic Auth commonly arises when authentication is enabled but access controls, transport protections, or credential handling are incomplete. Basic Auth transmits credentials in a base64-encoded string that is easily reversible; therefore, it must only be used over TLS. A misconfiguration occurs when an Axum server accepts Basic Auth on an HTTP endpoint or when TLS is missing, allowing credentials to be intercepted on the network.

Another misconfiguration is improper scope or role mapping: Basic Auth typically provides a username and password, but Axum applications must map those to authorization checks (e.g., roles or permissions). If the mapping is omitted or defaults to permissive access, an attacker who obtains credentials can access admin or sensitive endpoints. MiddleBrick checks such authorization gaps under its BOLA/IDOR and Property Authorization tests, highlighting cases where authenticated identities are not properly constrained.

A concrete Axum example of misconfigured Basic Auth is binding the authentication middleware to all routes without excluding public endpoints or enforcing per-route authorization. For instance, if an Axum router applies a Basic Auth extractor globally but does not validate credentials against a secure store or enforce least privilege, any valid credential pair can reach internal handlers that should be restricted. This becomes critical when combined with missing rate limiting, which allows credential spraying or brute-force attempts against the Basic Auth prompt.

Additionally, storing or logging credentials inadvertently (for example, logging user credentials in application logs or error messages) is a misconfiguration that exposes secrets. Axum applications that echo request headers or log raw extractor results without sanitization may leak credentials through logs or error payloads. The Data Exposure check in MiddleBrick flags such risky logging or responses that include authentication artifacts, and the Encryption check verifies that TLS is enforced for all Basic Auth traffic.

SSRF and unsafe consumption patterns can also interact with Basic Auth misconfiguration. If an Axum service accepts user-supplied URLs and performs authenticated requests using provided Basic Auth credentials, an attacker may force the server to relay credentials to internal services. MiddleBrick’s SSRF and Unsafe Consumption checks surface these risks by analyzing endpoints that accept external URLs and use extracted authentication material, emphasizing the need to validate and restrict destination addresses and credential scope.

To remediate Basic Auth misconfigurations in Axum, enforce TLS, validate credentials securely, scope access narrowly, and avoid logging sensitive data. The following patterns demonstrate a safer approach.

1. Enforce HTTPS for all routes that require authentication. Use Axum’s middleware to reject non-TLS requests or terminate TLS at the load balancer. Never accept Basic Auth over plain HTTP.

2. Use a typed extractor that validates credentials against a secure verification function and returns a minimal identity. Avoid echoing raw credentials in responses or logs.

use axum::{routing::get, Router, extract::Extension, http::HeaderMap};
use std::net::SocketAddr;
use tower_http::auth::{AuthLayer, Authorization};
use tower_http::auth::authorization::AuthorizationHeader;

async fn validate_credentials(username: &str, password: &str) -> bool {
    // Replace with secure lookup, e.g., constant-time comparison against a hashed store
    username == "admin" && password == "S3cur3P@ss!"
}

async fn handler() -> &'static str {
    "OK"
}

#[tokio::main]
async fn main() {
    let app = Router::new()
        .route("/api/secure", get(handler))
        .layer(
            AuthLayer::bearer_fn(|AuthorizationHeader(Some(token))| async move {
                // Basic Auth credentials are base64(username:password)
                let decoded = decode_basic_token(token);
                match decoded {
                    Some((user, pass)) if validate_credentials(&user, &pass).await => {
                        Ok(Authorization::authorized(user))
                    }
                    _ => Err(()),
                }
            }),
        )
        .check_state_is_invariant();

    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));
    println!("Listening on {}", addr);
    axum::Server::bind(&addr)
        .serve(app.into_make_service())
        .await
        .unwrap();
}

fn decode_basic_token(token: &str) -> Option<(String, String)> {
    use base64::Engine;
    const PREFIX: &str = "Basic ";
    token.strip_prefix(PREFIX).and_then(|b64| {
        let decoded = base64::engine::general_purpose::STANDARD.decode(b64).ok()?;
        let s = String::from_utf8(decoded).ok()?;
        let mut parts = s.splitn(2, ':');
        Some((parts.next()?.to_string(), parts.next()?.to_string()))
    })
}