Ssrf in Actix with Api Keys

Server-Side Request Forgery (SSRF) in Actix when API keys are used for external service authorization can expose internal infrastructure and bypass intended network boundaries. In this scenario, API keys are often passed as static configuration or via environment variables, and Actix routes forward requests to downstream services that require those keys. If the application accepts a target URL from an attacker and uses the same credentials to reach that URL, the API key can be leveraged to probe internal endpoints that are not directly exposed to the internet.

For example, an Actix service may accept a URL parameter to fetch data from a partner API, attaching an API key in the Authorization header. If input validation is weak and the service does not restrict destinations to approved domains, an attacker can supply a URL pointing to an internal metadata service, such as http://169.254.169.254 (AWS instance metadata), using the outbound API key to retrieve sensitive information. Because the API key is trusted by downstream services, the request appears legitimate, and SSRF can lead to data exposure, internal service enumeration, or further pivoting within a private network.

In an OpenAPI specification, this risk often appears when a parameter is defined as a string URL without strict format constraints or when external documentation references internal endpoints without clarifying network isolation. middleBrick detects SSRF by correlating runtime behavior with spec definitions, identifying cases where untrusted input can influence request targets that include authorization headers like API keys. Findings highlight the absence of destination allowlists and insufficient validation of user-supplied URLs, which are common precursors to successful SSRF attacks in Actix services that rely on key-based authentication.

Remediation focuses on strict destination allowlisting and avoiding the use of the same API key for user-influenced requests. Never forward user-supplied URLs while attaching credentials used for privileged internal services. Instead, use a proxy approach where the service calls predefined internal endpoints using API keys stored securely, and map user requests to internal operations without exposing raw URLs.

Below is a secure Actix example that validates the request path against an allowlist and attaches an API key only to known safe destinations. This pattern prevents SSRF by ensuring that user input cannot influence the target host or port.

use actix_web::{web, App, HttpResponse, HttpServer, Responder};
use reqwest::Client;
use std::collections::HashSet;

async fn proxy_data(path: web::Path, api_key: web::Data<String>) -> impl Responder {
    let allowed_hosts: HashSet<&str> = ["api.partner.com", "data.internal.corp"].iter().cloned().collect();
    let host = "api.partner.com"; // derived from path mapping, not user input

    if !allowed_hosts.contains(host.as_str()) {
        return HttpResponse::BadRequest().body("destination not allowed");
    }

    let client = Client::new();
    let url = format!("https://{}/v1/resource", host);
    let response = client
        .get(&url)
        .header("Authorization", format!("Bearer {}", *api_key))
        .send()
        .await;

    match response {
        Ok(resp) => HttpResponse::Ok().body(resp.text().await.unwrap_or_default()),
        Err(_) => HttpResponse::ServiceUnavailable().body("upstream error"),
    }
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    let api_key = web::Data::new(std::env::var("API_KEY").expect("API_KEY must be set"));
    HttpServer::new(move || {
        App::new()
            .app_data(api_key.clone())
            .route("/proxy/{path}", web::get().to(proxy_data))
    })
    .bind("0.0.0.0:8080")?
    .run()
    .await
}

For API key management, store keys in environment variables or a secrets manager, and avoid embedding them in code or spec examples that may be shared publicly. When using the middleBrick CLI to scan this service with middlebrick scan <url>, you can verify that SSRF findings related to credential leakage are absent. The Pro plan’s continuous monitoring can alert you if new routes introduce destinations that are not on the allowlist, helping maintain a secure boundary between user input and trusted API key usage.