CSRF & Security Hardening

use axum::{
    Form, Router,
    http::{HeaderName, HeaderValue, header},
    response::Html,
    routing::{get, post},
};
use tower::ServiceBuilder;
use tower_http::{
    csrf::CsrfLayer,
    sensitive_headers::SetSensitiveHeadersLayer,
    set_header::SetResponseHeaderLayer,
};

#[derive(serde::Deserialize)]
struct Review {
    text: String,
}

async fn page() -> Html<&'static str> {
    Html("<form method=post action=/reviews><textarea name=text></textarea><button>Send</button></form>")
}

async fn save(Form(r): Form<Review>) -> String {
    format!("saved {} bytes\n", r.text.len())
}

#[tokio::main]
async fn main() {
    let csrf = CsrfLayer::new().add_trusted_origin("https://bookshelf.example").expect("valid origin");
    let app = Router::new()
        .route("/reviews/new", get(page))
        .route("/reviews", post(save))
        .layer(csrf)
        .layer(
            ServiceBuilder::new()
                .layer(SetResponseHeaderLayer::overriding(
                    header::STRICT_TRANSPORT_SECURITY,
                    HeaderValue::from_static("max-age=63072000; includeSubDomains"),
                ))
                .layer(SetResponseHeaderLayer::if_not_present(
                    header::CONTENT_SECURITY_POLICY,
                    HeaderValue::from_static(
                        "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; \
                         object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'",
                    ),
                ))
                .layer(SetResponseHeaderLayer::overriding(header::X_CONTENT_TYPE_OPTIONS, HeaderValue::from_static("nosniff")))
                .layer(SetResponseHeaderLayer::overriding(
                    header::REFERRER_POLICY,
                    HeaderValue::from_static("strict-origin-when-cross-origin"),
                )),
        )
        .layer(SetSensitiveHeadersLayer::new([
            header::AUTHORIZATION,
            header::COOKIE,
            header::SET_COOKIE,
            HeaderName::from_static("x-api-key"),
        ]));
    let listener = tokio::net::TcpListener::bind("127.0.0.1:3000").await.unwrap();
    axum::serve(listener, app).await.unwrap();
}

$ curl -s -o /dev/null -w '%{http_code}\n' -d 'text=hi' -H 'sec-fetch-site: cross-site' \
    -H 'origin: https://evil.example' localhost:3000/reviews
403
$ curl -s -d 'text=hi' -H 'sec-fetch-site: same-origin' localhost:3000/reviews
saved 2 bytes
$ curl -sI localhost:3000/reviews/new | grep -i -E 'strict-transport|content-security|nosniff|referrer'
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self'; ...
strict-transport-security: max-age=63072000; includeSubDomains

$ cargo install cargo-audit cargo-deny
$ cargo audit                 # RustSec advisory database: known vulnerabilities and unmaintained crates
$ cargo deny init             # writes deny.toml
$ cargo deny check            # advisories + licenses + banned crates + duplicate versions + allowed sources

use std::collections::HashSet;
use std::hash::{BuildHasher, RandomState};
use std::net::IpAddr;
use std::sync::{
    Arc, Mutex,
    atomic::{AtomicU32, Ordering},
};
use std::time::Duration;

use metrics::counter;
use moka::future::Cache;
use tracing::warn;

/// Thresholds per 10-minute window; tune them from your own traffic.
const DISTINCT_ACCOUNTS_PER_IP: usize = 20; // credential stuffing: one source, many accounts
const FAILURES_PER_ACCOUNT: u32 = 10; // brute force: one account, many guesses
const FOREIGN_OBJECTS_PER_USER: usize = 50; // enumeration/exfiltration: one user, many others' objects

/// In-process abuse signals. Counters go to metrics *without* per-user labels; the per-key
/// state lives in TTL caches, and only threshold crossings are logged, as security events.
#[derive(Clone)]
struct SecuritySignals {
    accounts_per_ip: Cache<IpAddr, Arc<Mutex<HashSet<u64>>>>,
    failures_per_account: Cache<u64, Arc<AtomicU32>>,
    foreign_objects_per_user: Cache<i64, Arc<Mutex<HashSet<i64>>>>,
    hasher: RandomState, // usernames are hashed: the detector never stores them
}

impl SecuritySignals {
    fn new() -> Self {
        let window = Duration::from_secs(600);
        Self {
            accounts_per_ip: Cache::builder().max_capacity(100_000).time_to_live(window).build(),
            failures_per_account: Cache::builder().max_capacity(100_000).time_to_live(window).build(),
            foreign_objects_per_user: Cache::builder().max_capacity(100_000).time_to_live(window).build(),
            hasher: RandomState::new(),
        }
    }

    /// Call from the login handler after every attempt.
    async fn login_attempt(&self, ip: IpAddr, username: &str, success: bool) {
        let outcome = if success { "success" } else { "failure" };
        counter!("auth_login_attempts_total", "outcome" => outcome).increment(1);

        let account = self.hasher.hash_one(username);
        let accounts = self.accounts_per_ip.get_with(ip, async { Arc::default() }).await;
        let distinct = {
            let mut set = accounts.lock().expect("poisoned");
            set.insert(account);
            set.len()
        };
        if distinct == DISTINCT_ACCOUNTS_PER_IP {
            counter!("security_events_total", "kind" => "credential_stuffing").increment(1);
            warn!(target: "security", event = "credential_stuffing_suspected", %ip, distinct_accounts = distinct);
        }

        if !success {
            let failures = self.failures_per_account.get_with(account, async { Arc::default() }).await;
            if failures.fetch_add(1, Ordering::Relaxed) + 1 == FAILURES_PER_ACCOUNT {
                counter!("security_events_total", "kind" => "brute_force").increment(1);
                warn!(target: "security", event = "brute_force_suspected", account = account, %ip);
            }
        }
    }

    /// Call wherever an object is loaded on behalf of a user (a loan, a reading list, an export).
    async fn object_access(&self, user_id: i64, owner_id: i64, object_id: i64, allowed: bool) {
        if !allowed {
            // a denied access to someone else's object is the classic IDOR/BOLA probe
            counter!("authz_denied_total", "resource" => "loan").increment(1);
            warn!(target: "security", event = "access_denied", user_id, object_id);
        }
        if owner_id == user_id {
            return;
        }
        // allowed or not: how many *other people's* objects has this user touched recently?
        let seen = self.foreign_objects_per_user.get_with(user_id, async { Arc::default() }).await;
        let distinct = {
            let mut set = seen.lock().expect("poisoned");
            set.insert(object_id);
            set.len()
        };
        if distinct == FOREIGN_OBJECTS_PER_USER {
            counter!("security_events_total", "kind" => "bulk_foreign_access").increment(1);
            warn!(target: "security", event = "bulk_foreign_access_suspected", user_id, distinct_objects = distinct);
        }
    }
}

#[tokio::main]
async fn main() {
    tracing_subscriber::fmt().with_target(true).without_time().init();
    let signals = SecuritySignals::new();

    // one address trying a leaked list of username/password pairs
    let stuffer: IpAddr = "203.0.113.7".parse().unwrap();
    for n in 0..25 {
        signals.login_attempt(stuffer, &format!("member{n}@example.com"), false).await;
    }
    // many addresses guessing one account's password
    for n in 0..12u8 {
        signals.login_attempt(IpAddr::from([198, 51, 100, n]), "ursula@bookshelf.example", false).await;
    }
    // a librarian (allowed) or an attacker walking loan ids: /api/v1/loans/1000, /1001, ...
    for loan_id in 1000..1060 {
        signals.object_access(7, 42, loan_id, loan_id % 2 == 0).await;
    }
}

$ NO_COLOR=1 cargo run | grep -v access_denied
 WARN security: event="credential_stuffing_suspected" ip=203.0.113.7 distinct_accounts=20
 WARN security: event="brute_force_suspected" account=12092160862863416353 ip=198.51.100.9
 WARN security: event="bulk_foreign_access_suspected" user_id=7 distinct_objects=50

groups:
  - name: bookshelf-security
    rules:
      - alert: LoginFailureRatioHigh            # stuffing across many sources
        expr: |
          sum(rate(auth_login_attempts_total{outcome="failure"}[10m]))
            / sum(rate(auth_login_attempts_total[10m])) > 0.5
          and sum(rate(auth_login_attempts_total[10m])) > 1
        for: 10m
        labels: {severity: page}
      - alert: SecurityEventsDetected           # thresholds crossed in any replica
        expr: sum by (kind) (increase(security_events_total[15m])) > 0
        labels: {severity: ticket}
      - alert: AccessDeniedSpike                # IDOR/BOLA probing
        expr: sum(rate(authz_denied_total[5m])) > 3 * sum(rate(authz_denied_total[1d] offset 1d))
        for: 15m
        labels: {severity: ticket}