iet-auth-session-axum

Authenticates requests from a bearer session credential.

How to use it

Registers bearer-authenticated session REST endpoints: an identity lookup (iet_auth::Authenticate<Secret<String>>) and optional logout (iet_auth::Invalidate). Pair it with the session/opaque mechanism that issues the bearer token; bearer() enforces a single, strict Authorization: Bearer header.

// examples/htmx-starter/servers/web/tests/framework_auth_rest.rs
let api = iet_auth_session_axum::register(api, "/me", sessions.clone()).unwrap();
let api =
    iet_auth_session_axum::register_logout(api, "/logout", sessions.clone()).unwrap();

• register mounts auth.session; register_logout mounts auth.logout and only accepts a mechanism that performs real invalidation.
• iet_auth_session_axum::bearer(&headers) rejects ambiguous or malformed credentials.
• Responses are Cache-Control: no-store.

How it works

register mounts GET {path} as the auth.session module and resolves the strict bearer header through Authenticate<Secret<String>>; register_logout mounts POST {path} as auth.logout and calls Invalidate<Secret<String>>.

flowchart LR
  Get["GET path"] --> IdRoute["auth.session module"]
  IdRoute --> Bearer["bearer"]
  IdRoute --> Identity["api identity"]
  Identity --> Auth["Authenticate Secret"]
  Auth --> Resp["IdentityResponse no-store"]
  Post["POST logout"] --> LogoutRoute["auth.logout module"]
  LogoutRoute --> Logout["api logout"]
  Logout --> Inval["Invalidate Secret"]

What it implements

• Concrete mechanism; see the public API below.

What's inside

Modules

• src/api.rs
• src/dto.rs
• src/injector.rs
• src/lib.rs

Public API

injector

• pub fn bearer(headers: &HeaderMap) -> AppResult<Secret<String>> — Strict single Authorization header; credentials are never accepted in URLs.
• pub fn register<S, A, L>( api: RestApi<S, L>, path: &str, authentication: Arc<A>, ) -> AppResult<RestApi<S, L>> where L: iet_http_axum::RateLimit, S: Clone + Send + Sync + 'static, — Registers identity lookup; suitable for stateless JWT or opaque sessions.
• pub fn register_logout<S, A, L>( api: RestApi<S, L>, path: &str, authentication: Arc<A>, ) -> AppResult<RestApi<S, L>> where L: iet_http_axum::RateLimit, S: Clone + Send + Sync + 'static, — Registers logout only when the selected mechanism performs actual invalidation.

Depends on

• iet-core
• iet-auth
• iet-http-axum

External crates: axum, serde

Used by

• No other framework crate depends on it directly.

In this repository

• examples/htmx-starter

Source: crates/integrations/iet-auth-session-axum