use axum::{
extract::{FromRequestParts, State},
http::{request::Parts, StatusCode},
response::{IntoResponse, Response},
Json,
};
use serde_json::json;
use crate::state::{verify_token, AppState};
#[derive(Debug, Clone)]
pub struct AuthUser {
pub id: String,
pub scopes: Vec<String>,
}
#[derive(Debug)]
pub enum AuthError {
MissingToken,
InvalidToken,
Expired,
}
impl IntoResponse for AuthError {
fn into_response(self) -> Response {
let msg = match self {
AuthError::MissingToken => "missing bearer token",
AuthError::InvalidToken => "invalid bearer token",
AuthError::Expired => "token expired",
};
(StatusCode::UNAUTHORIZED, Json(json!({ "error": msg }))).into_response()
}
}
impl<S> FromRequestParts<S> for AuthUser
where
S: Send + Sync,
{
type Rejection = AuthError;
async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self, Self::Rejection> {
let header = parts
.headers
.get(axum::http::header::AUTHORIZATION)
.and_then(|v| v.to_str().ok())
.ok_or(AuthError::MissingToken)?;
let token = header
.strip_prefix("Bearer ")
.ok_or(AuthError::InvalidToken)?
.trim();
let State(app): State<AppState> = parts
.extract::<State<AppState>>()
.await
.map_err(|_| AuthError::InvalidToken)?;
verify_token(&app, token)
}
}
use std::sync::Arc;
use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation};
use serde::Deserialize;
use crate::auth::{AuthError, AuthUser};
#[derive(Clone)]
pub struct AppState {
inner: Arc<Inner>,
}
struct Inner {
decoding_key: DecodingKey,
validation: Validation,
}
#[derive(Debug, Deserialize)]
struct Claims {
sub: String,
#[serde(default)]
scopes: Vec<String>,
}
impl AppState {
pub fn new(secret: &[u8], audience: &str) -> Self {
let mut validation = Validation::new(Algorithm::HS256);
validation.set_audience(&[audience]);
validation.leeway = 30;
AppState {
inner: Arc::new(Inner {
decoding_key: DecodingKey::from_secret(secret),
validation,
}),
}
}
}
pub fn verify_token(state: &AppState, token: &str) -> Result<AuthUser, AuthError> {
let data = decode::<Claims>(token, &state.inner.decoding_key, &state.inner.validation)
.map_err(|e| match e.kind() {
jsonwebtoken::errors::ErrorKind::ExpiredSignature => AuthError::Expired,
_ => AuthError::InvalidToken,
})?;
Ok(AuthUser {
id: data.claims.sub,
scopes: data.claims.scopes,
})
}
use axum::{routing::get, Json, Router};
use serde_json::{json, Value};
mod auth;
mod state;
use auth::AuthUser;
use state::AppState;
async fn protected_route(user: AuthUser) -> Json<Value> {
Json(json!({
"id": user.id,
"scopes": user.scopes,
}))
}
async fn health() -> &'static str {
"ok"
}
#[tokio::main]
async fn main() {
let secret = std::env::var("JWT_SECRET").expect("JWT_SECRET must be set");
let state = AppState::new(secret.as_bytes(), "api.example.com");
let app = Router::new()
.route("/health", get(health))
.route("/me", get(protected_route))
.with_state(state);
let listener = tokio::net::TcpListener::bind("0.0.0.0:3000")
.await
.expect("bind failed");
axum::serve(listener, app).await.expect("server failed");
}
This snippet shows how token authentication is wired into axum as a custom extractor rather than as ad-hoc code inside every handler. The AuthUser extractor tab defines a lightweight AuthUser type that any handler can request in its argument list; when it appears, axum runs the extractor before the handler body, so a route only compiles with an authenticated user in scope. This is the idiomatic way to enforce cross-cutting concerns in axum: the type system makes authentication a precondition rather than a convention.
The extractor is implemented via FromRequestParts because a bearer token lives in the request headers and never needs the body, which keeps the extractor cheap and lets it compose with body extractors like Json in the same handler signature. from_request_parts pulls the Authorization header, strips the Bearer prefix, and rejects malformed input early. Note the use of parts.extract::<State<AppState>>() to reach shared application state without threading it through the function signature manually.
The AuthError type centralizes failure modes and implements IntoResponse, so returning an error from the extractor produces a real HTTP status and JSON body. This matters because an extractor's Rejection type is what the framework renders when authentication fails; mapping MissingToken, InvalidToken, and Expired to distinct 401 responses gives clients actionable feedback while never leaking internal detail.
The AppState and verify tab holds the AppState with a decoding key and the verify_token function that does the real cryptographic work using jsonwebtoken. Validation is configured up front with an expected audience and leeway, and the decoded Claims are converted into an AuthUser. Keeping verification in state means the key is loaded once at startup, not per request.
The router wiring tab shows the payoff: protected_route simply names AuthUser as a parameter and receives a verified user, while AppState is shared through with_state. The trade-off is that every protected handler pays a small verification cost per call; for higher throughput a caching layer or a tower middleware layer applied to a route group would be preferable. This pattern shines when different routes need different guarantees, since extractors compose per handler.
Related snips
payload = {
sub: user.id,
iss: 'https://auth.example.com',
aud: 'codesnips-api',
exp: 15.minutes.from_now.to_i,
iat: Time.now.to_i,JWT issuance and verification without common footguns
export interface RetryOptions {
retries: number;
baseMs: number;
maxMs: number;
signal?: AbortSignal;
onRetry?: (attempt: number, delay: number, err: unknown) => void;Exponential backoff with jitter for retries
// Creating a Promise
const myPromise = new Promise((resolve, reject) => {
const success = true;
setTimeout(() => {
if (success) {Promises and async/await patterns for asynchronous JavaScript
export type Settled<R> =
| { status: 'fulfilled'; value: R }
| { status: 'rejected'; reason: unknown };
export interface ConcurrencyOptions {
limit: number;Simple concurrency limiter for batch operations
#!/usr/bin/env bash
set -euo pipefail
export VAULT_ADDR="https://vault.internal:8200"
export VAULT_TOKEN="${VAULT_TOKEN:?missing VAULT_TOKEN}"Secrets management with environment isolation and Vault
import { randomBytes, createHash } from "crypto";
import jwt from "jsonwebtoken";
import { RefreshTokenStore } from "./store";
const ACCESS_SECRET = process.env.ACCESS_SECRET!;
const ACCESS_TTL = "15m";JWT access + refresh token rotation (conceptual)
Share this code
Here's the card — post it anywhere.
