Replay Attack in Axum with Basic Auth

A replay attack occurs when an attacker intercepts a valid authentication request and retransmits it to gain unauthorized access without knowing the underlying credentials. In Axum, using HTTP Basic Auth over a non-TLS connection exposes credentials in the form of a base64-encoded string that is static per request. Because base64 is easily reversible and the Authorization header does not include a nonce or timestamp, the same header can be captured and reused to impersonate the user or service. middleBrick scans for this pattern under its Authentication and Data Exposure checks, highlighting cases where Basic Auth is used without transport-layer protection and where requests lack mechanisms to prevent reuse.

In practice, an attacker on the same network or via a compromised proxy can observe the raw HTTP exchanges. With Basic Auth, the credentials are base64-encoded but not encrypted; if TLS is absent or terminated improperly, the encoded token can be decoded to obtain the username and password. Even when TLS is present, if the server does not enforce strict transport validation or if session tokens derived from Basic Auth are reused, the request can be replayed to privileged endpoints. The 12 parallel security checks in middleBrick evaluate whether replay risks exist by correlating authentication mechanisms with protections like idempotency controls, and the tool flags missing protections under BOLA/IDOR and Authentication findings.

For Axum services that rely solely on Basic Auth, the absence of per-request randomness makes the API an easy target. MiddleBrick’s unauthenticated scan can detect endpoints that accept static Authorization headers and surface them in the risk scoring output, assigning severity based on exposure and potential impact. Developers should treat Basic Auth as a transport identity mechanism only when coupled with TLS and should augment it with additional anti-replay controls such as one-time nonces or short-lived session exchanges.

To mitigate replay attacks in Axum, move away from relying solely on Basic Auth for stateful authentication. Instead, use Basic Auth only over TLS to establish an initial authenticated session, then transition to token-based validation. The following Axum examples show a secure approach: enforce HTTPS, validate credentials per request against a secure store, and integrate short-lived tokens to prevent header reuse.

First, ensure TLS is enforced at the router level so that all traffic is encrypted. Then, implement a Basic Auth extractor that validates credentials on each request but does not grant long-lived access. Combine this with a session or JWT mechanism that is validated on subsequent endpoints, reducing the window for replay.

use axum::{
    async_trait,
    extract::{FromRequest, Request},
    http::{self, HeaderValue, StatusCode},
};
use std::convert::Infallable;
use headers::authorization::{Authorization, Basic};

struct AuthenticatedUser {
    user_id: String,
}

#[async_trait]
impl FromRequest for AuthenticatedUser
where
    S: Send + Sync,
{
    type Rejection = (StatusCode, String);

    async fn from_request(req: Request, state: &S) -> Result {
        let authorization = req.headers().get(http::header::AUTHORIZATION)
            .ok_or((StatusCode::UNAUTHORIZED, "Missing Authorization header".to_string()))?;
        let basic = authorization.parse::>()
            .map_err(|_| (StatusCode::UNAUTHORIZED, "Invalid authorization format".to_string()))?;
        let user = basic.user_id();
        let pass = basic.password().ok_or((StatusCode::UNAUTHORIZED, "Missing password".to_string()))?;

        // Validate credentials against a secure store (example stub)
        if validate_credentials(user, pass).await {
            Ok(AuthenticatedUser { user_id: user.to_string() })
        } else {
            Err((StatusCode::UNAUTHORIZED, "Invalid credentials".to_string()))
        }
    }
}

async fn validate_credentials(user: &str, pass: &str) -> bool {
    // In production, use a constant-time comparison and secure backend
    user == "legitimate" && pass == "correct_hashed_password_reference"
}