Description

This detector identifies Rust web applications using the actix_web framework that have disabled or misconfigured HTTP Strict Transport Security (HSTS) headers. HSTS is a security mechanism that forces browsers to use secure HTTPS connections, and disabling it leaves applications vulnerable to man-in-the-middle attacks and protocol downgrade attacks.

Detection Strategy

• The detector first checks if the actix_web library is imported in the Rust code

• It then examines HTTP header configurations to find instances where HSTS (Strict-Transport-Security) headers are being set

• The detector analyzes the value assigned to the HSTS header to determine if it represents an unsafe or disabled configuration

• A vulnerability is reported when the HSTS header value is found to be disabled, improperly configured, or set to unsafe values that don't enforce secure transport

Vulnerable code example

use actix_web::{middleware::DefaultHeaders, HttpResponse};

fn vulnerable_app() {
    // Vulnerable - max-age=0 disables HSTS protection
    DefaultHeaders::new().add(("Strict-Transport-Security", "max-age=0"));
}

async fn vulnerable_handler() -> HttpResponse {...

✅ Secure code example

use actix_web::{middleware::DefaultHeaders, HttpResponse};

fn secure_app() {
    // Secure - max-age=31536000 (1 year) with includeSubDomains for full HSTS protection
    DefaultHeaders::new().add(("Strict-Transport-Security", "max-age=31536000; includeSubDomains"));
}

async fn secure_handler() -> HttpResponse {...