Webhook Abuse in Axum with Mutual Tls

Webhook abuse in Axum when protected by Mutual TLS (mTLS) can occur when the mTLS setup restricts transport-layer identity but does not enforce application-level authorization for the webhook target. Axum routes are compiled to handlers that receive strongly typed requests; if a webhook endpoint accepts requests authenticated only by client certificates without validating the caller’s scope, permissions, or origin, attackers can leverage a compromised or rogue certificate to invoke privileged handlers.

Consider an Axum webhook route that processes events such as payment.completed. The route uses mTLS to ensure the client presents a valid certificate, but it does not validate which service principal (identified in the certificate) is allowed to trigger that webhook. Because mTLS ensures identity but not authorization, an attacker who obtains a valid client certificate (for example, through theft, misconfigured issuance, or a compromised container) can replay requests or invoke rate-sensitive endpoints, leading to denial-of-service, duplicate processing, or unauthorized business actions.

Additionally, webhook abuse can arise from insufficient verification of event metadata and replay protections. Even with mTLS, an attacker can capture and replay a signed request if the server does not include nonce, timestamp, or idempotency checks. In Axum, handlers often deserialize a JSON body; if the handler trusts the payload without verifying business constraints (e.g., ensuring the webhook origin matches an expected issuer or that resource ownership aligns with the certificate identity), this can lead to insecure direct object references (IDOR) or privilege escalation across tenant boundaries.

OpenAPI/Swagger analysis can highlight webhook paths and indicate whether security schemes rely solely on mTLS. Cross-referencing spec definitions with runtime findings helps identify whether certificate-based authentication is paired with application-level checks. Because mTLS operates at the transport layer, it does not protect against business logic flaws; Axum applications must complement mTLS with explicit authorization checks, strict input validation, and replay-resistant design to avoid webhook abuse.

To secure Axum webhook endpoints with mTLS, couple transport identity with application-level authorization and strict validation. Use Axum’s extractor pattern to retrieve the peer certificate or its metadata, then enforce that the certificate matches an allow-list or maps to an authorized service/role before processing the webhook.

Below is a concrete, working Axum example that demonstrates mTLS verification and authorization checks. The server requires a client certificate, extracts the subject common name (CN), and allows only specific identities to invoke the webhook. It also validates a timestamp to mitigate replay attacks.

use axum::{
    async_trait, body::Body, extract::FromRequest, http::request::Parts, response::IntoResponse,
    routing::post, Router,
};
use openssl::ssl::{SslAcceptor, SslFiletype, SslMethod};
use std::collections::HashSet;
use std::convert::Infallible;
use std::net::SocketAddr;
use std::sync::Arc;
use time::OffsetDateTime;

// Shared authorization state: allowed certificate subjects
struct AppState {
    allowed_subjects: HashSet,
    max_clock_skew_seconds: i64,
}

// Extract certificate CN from the TLS session
struct ClientCert {
    subject_cn: String,
    timestamp: i64,
}

#[async_trait]
impl FromRequest for ClientCert
where
    S: Send + Sync,
{
    type Rejection = (axum::http::StatusCode, String);

    async fn from_request(req: &Parts, state: &S) -> Result {
        let app_state = state.downcast_ref::>().ok_or_else(|| {
            (axum::http::StatusCode::INTERNAL_SERVER_ERROR, "Missing app state".to_string())
        })?;

        // Obtain peer certificate from the TLS session via extensions (provided by the runtime)
        let peer_certs = req.extensions.get::>>()
            .ok_or_else(|| (axum::http::StatusCode::FORBIDDEN, "No client certificate".to_string()))?;
        if peer_certs.is_empty() {
            return Err((axum::http::StatusCode::FORBIDDEN, "No client certificate".to_string()));
        }

        // In practice, use an X.509 parser (e.g., `openssl` or `x509-parser`) to extract CN.
        // For this example, assume a helper that returns the CN string.
        let subject_cn = extract_subject_cn(&peer_certs[0]).map_err(|_| {
            (axum::http::StatusCode::FORBIDDEN, "Invalid certificate".to_string())
        })?;

        // Extract timestamp from a custom header to prevent replay
        let timestamp = req.headers()
            .get("X-Webhook-Timestamp")
            .and_then(|v| v.to_str().ok())
            .and_then(|s| s.parse::().ok())
            .ok_or_else(|| (axum::http::StatusCode::BAD_REQUEST, "Missing or invalid timestamp".to_string()))?;

        let now = OffsetDateTime::now_utc().unix_timestamp();
        let skew = app_state.max_clock_skew_seconds;
        if (timestamp - now).abs() > skew {
            return Err((axum::http::StatusCode::FORBIDDEN, "Timestamp skew too large".to_string()));
        }

        if !app_state.allowed_subjects.contains(&subject_cn) {
            return Err((axum::http::StatusCode::FORBIDDEN, "Subject not authorized".to_string()));
        }

        Ok(ClientCert { subject_cn, timestamp })
    }
}

fn extract_subject_cn(cert_der: &[u8]) -> Result {
    // Placeholder: integrate with an X.509 parsing library to extract CN.
    // This is intentionally simplified for example purposes.
    if cert_der.starts_with(b"CN=allowed-service") {
        Ok("allowed-service".to_string())
    } else {
        Err(())
    }
}

async fn webhook_handler(
    ClientCert { subject_cn, timestamp }: ClientCert,
    axum::Json(payload): axum::Json,
) -> impl IntoResponse {
    // Additional application-level checks (e.g., verify issuer mapping, idempotency keys)
    (axum::http::StatusCode::OK, format!("Accepted webhook from {}", subject_cn))
}

#[tokio::main]
async fn main() -> Result<(), Box> {
    let mut ssl_builder = SslAcceptor::mozilla_server(SslMethod::tls_server()).unwrap();
    ssl_builder.set_private_key_file("key.pem", SslFiletype::PEM)?;
    ssl_builder.set_certificate_chain_file("cert.pem")?;
    ssl_builder.set_ca_file("ca.pem")?; // For client CA verification
    let ssl = ssl_builder.build();

    let app_state = Arc::new(AppState {
        allowed_subjects: ["allowed-service".to_string()].into_iter().collect(),
        max_clock_skew_seconds: 30,
    });

    let app = Router::new()
        .route("/webhook", post(webhook_handler))
        .with_state(app_state)
        .layer(axum::middleware::from_fn_with_state(
            app_state.clone(),
            move |state, request, next| {
                // Middleware can enforce additional policies here if needed
                async move { next.run(request).await }
            },
        ));

    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));
    let listener = tokio::net::TcpListener::bind(addr).await?;
    axum::serve(listener, app).ssl(ssl).await?;
    Ok(())
}