Biscuit actix middleware
This middleware allows service-wide extraction and parsing of biscuit tokens.
Authorization itself still need to be handled from within endpoint handlers.
The middleware expects a base64-encoded token through the bearer token HTTP authorization scheme (an Authorization: Bearer <token>
HTTP header). This token is deserialized and its cryptographic signatures verified with the provided public key.
- Requests without a bearer token are rejected with a HTTP
401 Unauthorized
error; - Requests with tokens that fail parsing or cryptographic verification are rejected with a HTTP
403 Forbidden
error.
Token extraction logic and error handling are configurable (see Configuration example).
Working example
Here is a web server exposing GET /hello
, only to tokens containing the role("admin")
fact. The public key used for verifying tokens is provided through the BISCUIT_PUBLIC_KEY
environment variable.
A complete, runnable example can be found in examples/readme.rs
, and can be run with BISCUIT_PUBLIC_KEY=<public key> cargo run --example readme
.
Optionally, you can enable tracing by running BISCUIT_PUBLIC_KEY=<public key> cargo run --example readme --features tracing
to observe middleware traces as logs in the console.
use ;
use BiscuitMiddleware;
use ;
async
async