Struct AuthConfig 

#[non_exhaustive]
pub struct AuthConfig {

    pub jwt_secret: Option<String>,
    pub jwt_algorithm: JwtAlgorithm,
    pub jwt_issuer: Option<String>,
    pub jwt_audience: Option<String>,
    pub access_token_ttl: Option<DurationStr>,
    pub refresh_token_ttl: Option<DurationStr>,
    pub jwks_url: Option<String>,
    pub jwks_cache_ttl: DurationStr,
    pub session_ttl: DurationStr,
    pub jwt_leeway: DurationStr,
    pub audience_required: bool,
    pub required_claims: Vec<String>,
    pub session_cookie_ttl: Option<DurationStr>,
    pub jwks_require_kid: bool,
    pub legacy_secrets: Vec<LegacySecret>,
}

Authentication configuration.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

jwt_secret: Option<String>

Required for HS256.

jwt_algorithm: JwtAlgorithm

jwt_issuer: Option<String>

If set, tokens with a different issuer are rejected.

jwt_audience: Option<String>

If set, tokens with a different audience are rejected.

access_token_ttl: Option<DurationStr>

Access token lifetime (e.g., “15m”, “1h”). Used by ctx.issue_token_pair().

refresh_token_ttl: Option<DurationStr>

Refresh token lifetime (e.g., “7d”, “30d”). Used by ctx.issue_token_pair().

jwks_url: Option<String>

Required for RS256; keys are fetched and cached automatically.

jwks_cache_ttl: DurationStr

JWKS cache TTL duration (e.g. “1h”, “30m”).

session_ttl: DurationStr

Session TTL duration (e.g. “7d”, “24h”). Used for WebSocket sessions.

jwt_leeway: DurationStr

Clock-skew tolerance for exp / nbf validation (e.g. “60s”, “5m”). Sites with NTP-synchronized clocks can drop this to “5s”; older deployments or clients with drifting clocks may need higher. Defaults to “60s”.

audience_required: bool

When true (default), jwt_audience must be set when auth is enabled. Set to false only during migration.

required_claims: Vec<String>

JWT spec claims that must be present in every token. Defaults to ["exp", "sub"]. Add "aud" here for claim-level enforcement in addition to the jwt_audience equality check.

session_cookie_ttl: Option<DurationStr>

Used for OAuth consent flow cookies. Defaults to the access token TTL.

jwks_require_kid: bool

Reject RS256 tokens that arrive without a kid header. Default: true. On shared issuers (Firebase, Clerk multi-app) a kidless token would validate against an arbitrary cached key, accepting tokens signed by any app the issuer exposes. Set to false only for providers that genuinely omit kid in token headers (rare).

legacy_secrets: Vec<LegacySecret>

Old HMAC secrets still accepted for validation (never for signing). Each entry carries a mandatory valid_until timestamp; expired entries are silently dropped at middleware construction.

Implementations

impl AuthConfig

pub fn access_token_ttl_secs(&self) -> i64

Resolved access token TTL in seconds. Minimum 1 to prevent zero-lifetime tokens.

pub fn refresh_token_ttl_days(&self) -> i64

Resolved refresh token TTL in days. Default 30; sub-day values floor to 1.

pub fn session_cookie_ttl_secs(&self) -> i64

Resolved session cookie TTL in seconds. Falls back to access_token_ttl_secs().

pub fn is_configured(&self) -> bool

Returns true when any credential or claim validation field is set.

pub fn validate(&self) -> Result<()>

Validate that the config is complete for the chosen algorithm.

pub fn is_hmac(&self) -> bool

Check if this config uses HMAC (symmetric) algorithms.

pub fn is_rsa(&self) -> bool

Check if this config uses RSA (asymmetric) algorithms.

Trait Implementations

impl Clone for AuthConfig

fn clone(&self) -> AuthConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AuthConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AuthConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.