Struct JsonWebToken 

pub struct JsonWebToken<P> {
    pub header: Header,
    pub validation: Validation,
    /* private fields */
}

Encrypts and validates JWTs using the configured keys and the jsonwebtoken crate.

Key Management (IMPORTANT)

The default JsonWebToken (and its underlying JsonWebTokenOptions::default()) generates a fresh, random 60-character symmetric signing key every time a new instance is created. This is convenient for tests or ephemeral development sessions, but it also means that previously issued tokens become invalid whenever you create a NEW JsonWebToken via JsonWebToken::default() (or JsonWebTokenOptions::default()), because each call generates a fresh random key. If you construct exactly one instance at startup and reuse it for the whole process lifetime, tokens remain valid for that lifetime; but creating additional instances later (including, but not limited to, during a process restart or horizontal scaling) invalidates tokens produced by earlier instances.

If you need session continuity beyond a single in-memory instance (e.g. across process restarts, deployments, horizontal scaling, or any re-instantiation), you MUST provide a stable (persistent) key. Do this by constructing a JsonWebToken with explicit JsonWebTokenOptions using a key loaded from an environment variable, file, KMS, or another secret management system.

Providing a Persistent Symmetric Key

use std::sync::Arc;
use axum_gate::codecs::jwt::{JsonWebToken, JwtClaims, RegisteredClaims, JsonWebTokenOptions};
use axum_gate::accounts::Account;
use axum_gate::prelude::{Role, Group};
use jsonwebtoken::{EncodingKey, DecodingKey};

// For the example we define a stable secret. In real code, load from env or secret manager.
let secret = "test-secret".to_string();

// Construct symmetric encoding/decoding keys
let enc_key = EncodingKey::from_secret(secret.as_bytes());
let dec_key = DecodingKey::from_secret(secret.as_bytes());

// Build options manually (do NOT call `JsonWebTokenOptions::default()` here)
let options = JsonWebTokenOptions {
    enc_key,
    dec_key,
    header: None,       // Use default header
    validation: None,   // Use default validation
};

// Create a codec that will survive restarts as long as JWT_SECRET stays the same
let jwt_codec = Arc::new(
    JsonWebToken::<JwtClaims<Account<Role, Group>>>::new_with_options(options)
);

When It Is Safe to Use the Default

• Unit / integration tests
• Short-lived local development where logout on restart is acceptable
• Disposable preview environments

When You Should NOT Use the Default

• Production services
• Any environment where user sessions must persist across restarts
• Multi-instance / horizontally scaled deployments

In those cases always supply a deterministic key source.

Fields

header: Header

The header used for encoding.

validation: Validation

Validation options for the JWT.

Implementations

impl<P> JsonWebToken<P>

pub fn new_with_options(options: JsonWebTokenOptions) -> Self

Creates a new instance with the given options.

Trait Implementations

impl<P: Clone> Clone for JsonWebToken<P>

fn clone(&self) -> JsonWebToken<P>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<P> Codec for JsonWebToken<P>

where P: Serialize + DeserializeOwned + Clone,

fn decode(&self, encoded_value: &[u8]) -> Result<Self::Payload>

Decodes the given value.

Errors

Returns an error if the header stored in JsonWebToken does not match the decoded value. The header can be retrieved from JsonWebToken::header.

type Payload = P

Type of the payload being encoded/decoded.

fn encode(&self, payload: &Self::Payload) -> Result<Vec<u8>>

Encode a payload into an opaque, implementation-defined byte vector.

impl<P> Default for JsonWebToken<P>

fn default() -> Self

Returns the “default value” for a type.