Arp Spoofing in Actix with Session Cookies

Arp Spoofing is a network-layer attack where an attacker sends falsified ARP messages to associate their MAC address with the IP address of another host, typically the default gateway. In an Actix web application that relies on Session Cookies for authentication, this attack can undermine the integrity of the session mechanism even when cookies are marked HttpOnly and Secure.

When an attacker successfully performs Arp Spoofing between the client and the Actix server, they can intercept, modify, or replay HTTP requests and responses. Because session cookies are transmitted in plaintext within HTTP headers, an attacker who is positioned as a man-in-the-middle can capture valid session identifiers. This enables session hijacking: the attacker uses the stolen session cookie to impersonate the victim without needing to know the user’s password.

The risk is particularly acute when the Actix service is deployed in environments where network segmentation is weak or where an attacker has the ability to inject themselves into the local network segment, such as in shared hosting, public Wi‑Fi, or misconfigured cloud virtual networks. Even if the application uses secure cookies and HTTPS, Arp Spoofing can bypass perimeter protections by operating within the trusted network path, making cookie-based authentication vulnerable to interception.

Additionally, if the Actix application does not implement strict transport security or binding between the session and other request attributes (such as IP or user-agent), replayed requests with a valid session cookie can be accepted seamlessly. This highlights the importance of correlating session state with contextual request properties and ensuring that session validation is not solely dependent on the presence of a cookie.

middleBrick can detect such risks by scanning the unauthenticated attack surface of an Actix endpoint and identifying missing or weak transport protections, insecure cookie attributes, and lack of binding between session context and request characteristics. Findings include severity ratings and remediation guidance mapped to frameworks such as OWASP API Top 10 and relevant compliance controls.

To mitigate Arp Spoofing risks when using Session Cookies in Actix, implement secure cookie attributes and enforce strict transport and session binding. Below are concrete, working examples of how to configure session cookies securely in Actix using the actix-session crate.

1. Secure Session Cookie Configuration

Ensure cookies are marked Secure, HttpOnly, and SameSite. Use CookieSession or RedisSession with proper settings. This reduces the impact of intercepted cookies on the wire.

use actix_session::{CookieSession, Session};
use actix_web::{web, App, HttpServer, HttpResponse};

async fn index(session: Session) -> HttpResponse {
    if let Some(user) = session.get::("user_id").unwrap() {
        HttpResponse::Ok().body(format!("Hello, {}", user))
    } else {
        HttpResponse::Unauthorized().body("Not authenticated")
    }
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    HttpServer::new(|| {
        App::new()
            .wrap(
                CookieSession::signed(&[0; 32]) // Use a strong, secret key in production
                    .secure(true)               // Only send over HTTPS
                    .http_only(true)            // Prevent JavaScript access
                    .same_site(actix_web::cookie::SameSite::Strict)
                    .max_age(time::Duration::hours(1)),
            )
            .route("/", web::get().to(index))
    })
    .bind("127.0.0.1:8080")?
    .run()
    .await
}

2. Enforce HTTPS and HSTS

Always serve Actix applications over TLS and include HTTP Strict Transport Security headers to prevent downgrade attacks that could facilitate Arp Spoofing. This ensures that browsers never send cookies over insecure channels.

use actix_web::{web, App, HttpServer, HttpResponse, middleware::Logger};

async fn index() -> HttpResponse {
    HttpResponse::Ok().body("Secure endpoint")
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    std::env::set_var("RUST_LOG", "actix_web=info");
    env_logger::init();

    HttpServer::new(|| {
        App::new()
            .wrap(Logger::default())
            .service(web::resource("/").to(index))
    })
    .bind_openssl("127.0.0.1:8443", {
        use openssl::ssl::{SslAcceptor, SslFiletype, SslMethod};
        let mut builder = SslAcceptor::mozilla_intermediate(SslMethod::tls()).unwrap();
        builder.set_private_key_file("key.pem", openssl::ssl::SslFiletype::PEM).unwrap();
        builder.set_certificate_chain_file("cert.pem").unwrap();
        builder.build()
    })?
    .run()
    .await
}

3. Bind Session to Request Context

Correlate session identifiers with the client’s IP address or user-agent to detect replay or hijacking attempts. While this can impact legitimate users behind proxies, it significantly raises the bar for successful Arp Spoofing attacks.

use actix_web::{web, HttpRequest, App, HttpServer, HttpResponse, dev::ServiceRequest};
use actix_session::Session;
use std::future::{ready, Ready};

fn validate_session(
    req: ServiceRequest,
    session: &Session,
) -> Result<ServiceRequest, (actix_web::Error, ServiceRequest)> {
    if let Some(stored_ip) = session.get::("client_ip").unwrap() {
        let current_ip = req.connection_info().realip_remote_addr().unwrap_or("");
        if stored_ip != current_ip {
            return Err((actix_web::error::ErrorUnauthorized("Session binding mismatch"), req));
        }
    }
    Ok(req)
}

async fn index(session: Session, req: HttpRequest) -> HttpResponse {
    if let Err(e) = validate_session(
        ServiceRequest::from_parts(req.into_parts(), ()),
        &session,
    ) {
        return HttpResponse::Unauthorized().body("Invalid session context");
    }
    HttpResponse::Ok().body("Valid session with binding")
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    HttpServer::new(|| {
        App::new()
            .wrap(
                CookieSession::signed(&[0; 32])
                    .secure(true)
                    .http_only(true)
                    .same_site(actix_web::cookie::SameSite::Strict),
            )
            .route("/", web::get().to(index))
    })
    .bind("127.0.0.1:8080")?
    .run()
    .await
}

For production deployments, consider using RedisSession to store session data server-side and only keep a session identifier in the cookie. This limits the exposure of session material and makes it harder for an attacker to leverage intercepted cookies even if Arp Spoofing occurs. middleBrick’s dashboard and CLI can be used to verify that secure cookie attributes and transport settings are consistently applied across your endpoints.