rustlavel-auth: sessions, API tokens, password hashing, CSRF, signed URLs.

Everything an application needs to know who is talking to it and to trust what they send. Like every rustlavel package it is opt-in: an application that never adds it never compiles a line of this.

use rustlavel_auth::prelude::*;

let sessions = SessionManager::from_config(&config, FileStore::new("storage/sessions"))?;
router.middleware(sessions);
router.middleware(Csrf::new());

router.group("/dashboard", |r| {
    r.middleware(Authenticate::from_config(&config));
    r.get("", |req: Request| async move {
        format!("hello, {}", req.identity().unwrap().id())
    });
});

Why the crypto crates are here

The framework builds from scratch on principle, and this crate follows that everywhere except the primitives: argon2, AES-GCM, HMAC and SHA-256 come from the RustCrypto crates. A hand-written cipher or KDF looks like it works from the first test and is a vulnerability regardless — this is the one place where writing less code is the safer engineering decision.