Integrity Failures in Axum with Mongodb

When building a REST or GraphQL API with Axum and MongoDB, integrity failures often arise from mismatched validation, weak schema design, or unsafe update patterns. In this stack, developers sometimes rely on client-provided identifiers for MongoDB document lookups without re-evaluating authorization context on each request. This can enable BOLA/IDOR-like scenarios where one user can read or modify another user’s data by guessing or iterating valid ObjectId values. Axum’s type-driven routing and extractor model make it straightforward to bind path parameters to handler arguments, but if those parameters are used directly in MongoDB filters without additional checks, the application may unintentionally expose or mutate records that should be isolated per user or tenant.

Another common integrity risk in Axum with MongoDB is partial updates that overwrite fields without merging existing data correctly. For example, using replace_one with a document built only from incoming JSON can drop fields that were not included in the request payload, effectively removing data the user did not intend to change. This violates data integrity by losing information that should persist, such as audit metadata or optional configuration fields. In addition, the lack of schema versioning or strict document validation in some MongoDB deployments means malformed or unexpected payloads can be stored, which later leads to application-level errors or inconsistent reads. These issues are especially dangerous when coupled with missing server-side validation, as malformed inputs may bypass Axum’s extractors and reach the database unchecked.

SSRF and unsafe consumption patterns also contribute to integrity failures in this combination. If Axum endpoints accept URLs or hostnames and pass them directly to MongoDB operations—such as building connection strings or storing user-supplied URIs without validation—an attacker may induce the server to access internal MongoDB instances or configuration endpoints. This can lead to unauthorized data exposure or manipulation. Moreover, when the API deserializes untrusted input into MongoDB update operators like $set or $inc without strict type checks, it may allow injection of unexpected operators or malformed values that corrupt document structures. Proper schema design, runtime validation, and strict operator whitelisting are essential to preserve integrity in an Axum and MongoDB architecture, ensuring that only intended fields are modified and that data remains consistent across concurrent requests.

To mitigate integrity failures in Axum with MongoDB, apply strict validation, parameterized queries, and controlled update patterns. Always resolve the requesting user from the request context (e.g., via authentication extractor) and combine it with the target identifier in a single MongoDB filter. This ensures that operations cannot act on documents belonging to other users even if the identifier is supplied by the client. Use strongly typed structs for both incoming payloads and database documents, and validate them before constructing update expressions. Avoid building MongoDB filters from raw path parameters without cross-checking ownership or tenant context.

For safe updates, prefer $set with explicit field paths rather than full document replacement unless intended. Use MongoDB’s validation schema where available to enforce document structure at the server level, and implement application-level checks in Axum extractors and guards. Below are concrete, working examples for Axum with the official MongoDB Rust driver.

Example 1: Safe document fetch with ownership check

use axum::{routing::get, Router, extract::Path, http::StatusCode};
use mongodb::{Client, Collection};
use serde::{Deserialize, Serialize};
use std::sync::Arc;

#[derive(Debug, Serialize, Deserialize)]
struct UserProfile {
    #[serde(rename = "_id")]
    id: mongodb::bson::oid::ObjectId,
    user_id: String,
    display_name: String,
    email: String,
}

async fn get_profile(
    Path(id): Path,
    user_profile_collection: Arc>,
    current_user_id: String, // from auth extractor
) -> Result {
    let obj_id = mongodb::bson::oid::ObjectId::parse_str(&id)
        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid ID".to_string()))?;

    let filter = doc! {
        "_id": obj_id,
        "user_id": ¤t_user_id,
    };
    let profile = user_profile_collection.find_one(filter, None)
        .await
        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
        .ok_or((StatusCode::NOT_FOUND, "Profile not found".to_string()))?;

    Ok(serde_json::to_string(&profile)?.to_string())
}

fn app() -> Router {
    let client = Client::with_uri_str("mongodb://localhost:27017").await.unwrap();
    let collection: Collection = client.database("appdb").collection("profiles");
    Router::new()
        .route("/profiles/:id", get(move |path, current_user_id| get_profile(path, Arc::clone(&collection), current_user_id)))
}

Example 2: Controlled update with $set and type validation

use mongodb::bson::{doc, Document};

async fn update_display_name(
    user_profile_collection: Arc>,
    profile_id: String,
    current_user_id: String,
    body: serde_json::Value,
) -> Result {
    let obj_id = mongodb::bson::oid::ObjectId::parse_str(&profile_id)
        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid ID".to_string()))?;

    // Validate and extract only allowed fields
    let new_name = body.get("display_name")
        .and_then(|v| v.as_str())
        .ok_or((StatusCode::BAD_REQUEST, "display_name is required and must be a string".to_string()))?;

    let filter = doc! {
        "_id": obj_id,
        "user_id": ¤t_user_id,
    };
    let update = doc! {
        "$set": { "display_name": new_name },
    };

    let result = user_profile_collection.update_one(filter, update, None)
        .await
        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    if result.matched_count == 0 {
        return Err((StatusCode::NOT_FOUND, "Profile not found or access denied".to_string()));
    }

    Ok(r#"{"status": "updated"}"#.to_string())
}

Example 3: Rejecting unsafe replacement and enforcing schema

async fn safe_replace(
    user_profile_collection: Arc>,
    profile_id: String,
    current_user_id: String,
    body: UserProfile,
) -> Result {
    let obj_id = mongodb::bson::oid::ObjectId::parse_str(&profile_id)
        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid ID".to_string()))?;

    // Ensure the submitted body’s ID matches the path ID and user ownership
    if body.id.to_string() != profile_id || body.user_id != current_user_id {
        return Err((StatusCode::FORBIDDEN, "Mismatch between path, body, or ownership".to_string()));
    }

    let filter = doc! {
        "_id": obj_id,
        "user_id": ¤t_user_id,
    };
    let update = doc! {
        "$set": {
            "display_name": body.display_name,
            "email": body.email,
        },
    };

    let result = user_profile_collection.update_one(filter, update, None)
        .await
        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    if result.matched_count == 0 {
        return Err((StatusCode::NOT_FOUND, "Profile not found or access denied".to_string()));
    }

    Ok(r#"{"status": "updated"}"#.to_string())
}