actix-jwt-authc
| Crates.io | actix-jwt-authc |
| lib.rs | actix-jwt-authc |
| version | 0.2.0 |
| created_at | 2022-07-04 05:59:10.309191+00 |
| updated_at | 2022-07-06 02:23:30.567182+00 |
| description | Actix middleware for authenticating JWTs with support for invalidation |
| homepage | |
| repository | https://github.com/lloydmeta/actix-jwt-authc |
| max_upload_size | |
| id | 618780 |
| size | 113,779 |
Lloyd (lloydmeta)
documentation
README
actix-jwt-authc
JWT authentication middleware for Actix that supports checking for invalidated JWTs without paying the cost of a per-request IO call. It sources invalidated JWTs from a Stream and stores them in memory.
This middleware is based on the assumption that since JWTs (should) have an expiry, ultimately, an in-memory set of explicitly-invalidated-yet-unexpired JWTs that are periodically reloaded should not be overwhelmingly big enough to cause problems. Only testing can truly answer if this assumption works for a given usecase.
Uses
- Actix
- jsonwebtoken for JWT encoding + validation
Features
tracingenables instrumentation by pulling in tracinglogenables logs (via tracing) using the compatibility layersessionenablesactix-sessionintegration, allowing you to extract JWTs from a configurable session key.
Example
The example included in this repo has
- A simple set of routes for starting and inspecting the current session
- An in-memory implementation of the invalidated JWT interface
- In-memory loop for purging expired JWTs from the store
- Channel-based Stream of invalidated JWT events for powering the invalidated JWT set used by the middleware
- ring to generate an Ed25519 keypair for EdDSA-signed JWTs
Both session and JWT keys are generated on the fly, so JWTs are incompatible across restarts.
It supports tracing and session as features. To run a server on 8080:
cargo run --example inmemory --features tracing,session
Supported endpoints
/loginto start a session/logoutto destroy the current session (requires a session)/sessionto inspect the current session (requires a session)/maybe_sesionto inspect the current session if it exists
If session is not passed, authentication in the example is dependent on Bearer tokens sent as an Authorization header.
Disclaimer
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.