Struct SubmitTokenConfig 

pub struct SubmitTokenConfig {
    pub enabled: bool,
    pub field_name: String,
    pub ttl_secs: u64,
    pub in_flight_ttl_secs: u64,
    pub backend: Option<IdempotencyBackend>,
    pub exempt_paths: Vec<String>,
}

One-time submit-token protection settings.

When enabled (the default), a per-render random token is exposed via the SubmitToken extractor and embedded as a hidden _submit_token field in scaffolded create/update forms. On the mutating POST the server consumes the token exactly once: a double-click, Back→resubmit, or browser retry carrying an already-consumed token replays the first response instead of re-running the handler, so no duplicate row is created — with no client-side JavaScript.

Unlike IdempotencyConfig, the guard is driven by a form field, not the Idempotency-Key header, so it protects bare browser form submits.

Defaults

Field	Default
enabled	true
field_name	"_submit_token"
ttl_secs	600 (10 min)
in_flight_ttl_secs	86_400 (24 h)
backend	inherits [idempotency].backend (in-memory in dev, Redis in prod)
exempt_paths	[]

Examples

[security.submit_token]
enabled = true
ttl_secs = 900
backend = "redis"   # override; reuses the [idempotency.redis] connection settings

Fields

enabled: bool

Enable one-time submit-token protection. Default: true.

field_name: String

Hidden form field name carrying the token. Default: "_submit_token".

ttl_secs: u64

Time-to-live in seconds for a consumed token’s stored response. Default: 600 (10 minutes).

in_flight_ttl_secs: u64

Maximum stale lifetime in seconds for an in-flight submission lock.

While a mutating request is running, its token is locked so a concurrent retry carrying the same token is excluded until the first request records its consumed response. The lock is released as soon as that record is stored, so this value is only the backend safety expiry for crashes or lost unlocks — it must be comfortably longer than any supported mutating request duration. Deliberately independent of ttl_secs (the replay window): lowering ttl_secs must never shorten how long an active submission is excluded from re-entry, which would let a slow request’s retry acquire a fresh lock and double-execute. Default: 86_400 (24 hours), matching [idempotency].in_flight_ttl_secs.

backend: Option<IdempotencyBackend>

Storage backend for consumed submit tokens.

When unset (the default, None), the submit-token store inherits the configured idempotency backend ([idempotency].backend): a Redis-configured app automatically shares one consumed-token store across replicas, while a dev app on the default in-memory idempotency backend keeps an in-memory token store. This matches issue #1360: the token store is backed by the existing idempotency/session store backend (in-memory in dev, Redis in prod), so a double-click load-balanced to a different replica cannot re-run the mutation in production.

Set explicitly to override the inherited backend for submit tokens only. When it resolves to "redis", the store reuses the [idempotency.redis] connection settings so a multi-replica deployment shares one token store.

Use Self::resolved_backend to obtain the effective backend.

exempt_paths: Vec<String>

Request path prefixes that are exempt from submit-token guarding. Default: [].

Implementations

impl SubmitTokenConfig

pub fn resolved_backend( &self, idempotency_backend: IdempotencyBackend, ) -> IdempotencyBackend

Resolve the effective consumed-token storage backend.

Returns the explicit backend override when one is configured; otherwise inherits idempotency_backend (the app’s [idempotency].backend) so submit tokens share the idempotency store by default. This is the single source of truth for backend selection so the idempotency layer and the submit-token layer cannot drift apart.

Trait Implementations

impl Clone for SubmitTokenConfig

fn clone(&self) -> SubmitTokenConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SubmitTokenConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SubmitTokenConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SubmitTokenConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.