HIGH timing attackaxumfirestore

Timing Attack in Axum with Firestore

Timing Attack in Axum with Firestore — how this specific combination creates or exposes the vulnerability

A timing attack in the combination of Axum and Firestore arises when response times vary measurably based on secret-dependent branches or operations. Firestore queries that conditionally check authentication tokens, user permissions, or record existence can introduce observable latency differences. In Axum, if route handling performs early returns or short-circuit logic based on Firestore lookups, an attacker can measure round-trip times to infer validity of usernames, API keys, or document IDs.

Consider an authentication flow where Axum first retrieves a user document from Firestore and then compares a provided token to a stored hash. If the Firestore read is skipped for non-existent users, the response is faster, revealing user existence. Even with constant-time comparison on the application side, the Firestore read latency itself becomes a side channel. Firestore’s regional distribution and underlying infrastructure variability can amplify this: cached queries may respond faster than uncached queries, and index misses may introduce additional delay that correlates with data presence.

The attack surface expands when Axum serves endpoints that accept user-supplied document paths or collection names. An attacker can probe paths that do or do not exist and observe timing differences in Firestore access patterns. Because Firestore bills and throttles based on operations, careless use of get() or list() inside Axum handlers can also expose operational behavior through latency. These timing differences are measurable over networks, especially in regions close to the Firestore instance, allowing an attacker to gradually infer information despite Axum’s otherwise robust type safety and routing ergonomics.

Firestore-Specific Remediation in Axum — concrete code fixes

To mitigate timing risks, ensure that Firestore interactions in Axum take constant time regardless of secrets or existence checks. Use consistent read patterns and avoid branching on sensitive data. Prefer batched reads or existence checks that do not reveal information through timing.

Example: safe authentication handler with constant-time behavior:

use axum::{routing::post, Json, Router};
use firestore_rs::{Client, FirestoreDb};
use std::time::Duration;

async fn authenticate_user(
    db: &FirestoreDb,
    Json(payload): Json<AuthPayload>,
) -> Result<impl IntoResponse, (StatusCode, String)> {
    // Always read a placeholder document to normalize timing
    let user_ref = db.collection("users").doc(&payload.username);
    let _user_doc = user_ref.get().await.map_err(|_| (StatusCode::UNAUTHORIZED, "Invalid credentials"))?;

    // Perform constant-time comparison using a dummy hash if user not found
    // (In practice, use a stored hash; this shows the pattern)
    let expected_hash = "dummy_hash_for_constant_time"; // Replace with actual secure lookup
    let _ = subtle::ConstantTimeEq::ct_eq(
        payload.token.as_bytes(),
        expected_hash.as_bytes(),
    );

    if /* actual verification fails */ false {
        return Err((StatusCode::UNAUTHORIZED, "Invalid credentials".into()).into());
}

#[derive(serde::Deserialize)]
struct AuthPayload {
    username: String,
    token: String,
}

This pattern ensures a read occurs regardless of user existence, reducing timing leakage. For Firestore list operations, paginate with fixed page sizes and always iterate the same number of times when possible.

Example: constant-time existence check with pagination:

use firestore_rs::{Client, FirestoreDb, Query};

async fn check_resource_exists(
    db: &FirestoreDb,
    base_path: &str,
) -> Result<bool, Box> {
    let query = Query::new(base_path)
        .limit(10) // Fixed page size to normalize timing
        .build();
    let results: Vec<serde_json::Value> = db.run_query(query).await?;
    // Always process up to limit to keep timing consistent
    for _ in results.iter().take(10) {
        // dummy iteration
    }
    Ok(results.len() == 10) // Indication logic should be adjusted to your use case
}

Additionally, configure retries and timeouts in Axum to a fixed budget, avoiding variable network-induced timing differences. Use middleware that enforces uniform request processing time where feasible. These practices align with OWASP API Top 10:2023’s Server-Side Request Forgery and Data Exposure considerations when combined with Firestore’s operational characteristics.

Frequently Asked Questions

Does middleBrick detect timing attack risks in Axum with Firestore scans?

Yes. middleBrick runs 12 security checks in parallel, including Input Validation and Property Authorization, which can identify timing-related anomalies in API behavior when scanning Axum endpoints that interact with Firestore.

Can the GitHub Action fail builds if timing-related findings appear during Firestore-related scans?

Yes. With the Pro plan, you can configure the GitHub Action to fail builds when security scores drop below your defined threshold, including findings that indicate timing attack risks in Firestore-integrated Axum APIs.

Timing Attack in Axum with Firestore