Enum Refusal 

pub enum Refusal {
    Expired,
    NotYetValid,
    AudienceMismatch,
    IssuerMismatch,
    NoSubject,
    Unscoped,
    Malformed,
    Unverified,
}

Why a presented token was refused.

Every variant is a distinct reason a 401 might be correct, and the HTTP layer does not get to choose between them on the way out: an expired token and a wrong-audience token produce the same status and the same challenge, because telling a caller which failed is telling it something about the token it should not learn.

Variants

Expired

The token had expired by now.

NotYetValid

The token’s nbf is in the future.

AudienceMismatch

The token is bound to some other resource.

The one refusal worth naming in a log rather than in a response body.

IssuerMismatch

The token named an issuer, and it is not the one expected.

Only reachable when the deployment configured an expected issuer.

NoSubject

The token had no subject, so it names nobody to attribute an action to.

Unscoped

The token carried no scope this deployment recognises.

A refusal rather than an empty ScopeSet, so that “valid token, no permissions” and “valid token, permissions the operator forgot to map” are distinguishable in a log even though both answer 401.

Malformed

The token was not a well-formed JWS at all.

Added when the JWT source arrived, which is the first TokenSource that can meet a token it cannot even parse. It is a refusal rather than SourceError::Unavailable because nothing was unavailable: the bytes arrived, and they were not a token. Filing it under Unavailable would send a caller to re-authenticate against an authorization server that answered perfectly well — and would report a client’s credentials as bad when the real fault was a middlebox mangling a header.

Unverified

The token parsed, but its signature could not be established as genuine.

Distinct from Malformed and from every rule in verify, and both distinctions are load-bearing. A malformed token is the caller’s bug and can be reported as one; an unverifiable one is either a token this server should not accept or a key it could not fetch, and a log that collapses the two sends an on-call engineer to the wrong system.

Also the landing place for a bad signature. Folding that into AudienceMismatch would be tempting and wrong: an expired token and a forged one would then look identical in a log, which is the one distinction a forgery attack is trying to hide.

Trait Implementations

impl Clone for Refusal

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Refusal

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Refusal

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Refusal

impl Error for Refusal

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<Refusal> for SourceError

fn from(source: Refusal) -> Self

Converts to this type from the input type.

impl PartialEq for Refusal

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Refusal