Fix Shadow API Exposure in Rocket

Shadow APIs in Rocket are the silent killers of production clusters. They manifest when undocumented endpoints, legacy routes, or 'debug-only' handlers are inadvertently mounted to the production binary. These hidden attack surfaces bypass security reviews and often lack the Request Guards required for authentication, leaving sensitive internal state exposed to anyone with a fuzzer.

The Vulnerable Pattern

#[get("/debug/dump_state")]
fn dump_state() -> Json {
    // This was meant for local testing only
    Json(State::get_all())
}
#[launch]
fn rocket() -> _ {
rocket::build()
.mount(”/”, routes![index, login, dump_state]) // Shadow API: dump_state is mounted globally
}

The Secure Implementation

To kill shadow APIs, you must implement two layers of defense. First, use Rust's 'cfg' attributes or environment checks to ensure debug routes are never compiled into or mounted in the release binary. Second, enforce 'Secure by Default' routing by using Request Guards (like AdminGuard) on every endpoint. Even if a route is accidentally mounted, the guard will reject any request lacking valid credentials, effectively neutralizing the exposure. Always use a tool like 'okapi' to generate OpenAPI specs directly from your code to ensure your documentation matches reality.

struct AdminGuard;
#[rocket::async_trait]
impl<‘r> FromRequest<‘r> for AdminGuard {
type Error = ();
async fn from_request(req: &‘r Request<’_>) -> Outcome<Self, ()> {
// Enforce strict header or session check
match req.headers().get_one(“X-Internal-Key”) {
Some(key) if key == std::env::var(“INTERNAL_KEY”).unwrap() => Outcome::Success(AdminGuard),
_ => Outcome::Forward(()),
}
}
}
#[get(“/debug/dump_state”)]
fn dump_state(_guard: AdminGuard) -> Json {
Json(State::get_all())
}
#[launch]
fn rocket() -> _ {
let mut server = rocket::build().mount(”/”, routes![index, login]);
// Only mount sensitive routes in non-production environments
if cfg!(debug_assertions) {
    server = server.mount("/debug", routes![dump_state]);
}

server
}