Struct JwtLayer 

pub struct JwtLayer { /* private fields */ }

Available on crate feature auth only.

Middleware that verifies Authorization: Bearer <token> JWTs.

JwtLayer::new verifies HMAC-SHA256 (HS256) tokens against a shared secret. With the auth-asymmetric feature, JwtLayer::rs256 and JwtLayer::es256 verify tokens signed by a separate auth server’s private key, given only its public key.

Rejects tokens with a past exp claim. All other validation (format, algorithm, signature) is performed by verify_jwt / verify_jwt_rs256 / verify_jwt_es256.

If a handler also needs the decoded claims, call the matching verify_* function again inside the handler — verification is cheap.

Example

use rust_web_server::app::App;
use rust_web_server::auth::JwtLayer;
use rust_web_server::core::New;

let app = App::new().wrap(JwtLayer::new(b"my-signing-secret"));

Implementations

impl JwtLayer

pub fn new(secret: impl Into<Vec<u8>>) -> JwtLayer

Create a layer that verifies HS256 JWTs signed with secret.

pub fn secrets<I, S>(secrets: I) -> JwtLayer

where I: IntoIterator<Item = S>, S: Into<Vec<u8>>,

Create a layer that verifies HS256 JWTs signed with any of secrets (18.20.0): rotate by adding the new secret, keeping the old one until the tokens it signed have expired, then removing it.

pub fn secret_with_kid( self, kid: impl Into<String>, secret: impl Into<Vec<u8>>, ) -> JwtLayer

Also accept HS256 tokens signed with secret; a token whose header says "kid": kid is checked against this secret only.

pub fn rs256(public_key_pem: &str) -> Result<JwtLayer, String>

Available on crate feature auth-asymmetric only.

Create a layer that verifies RS256 JWTs against an RSA public key.

public_key_pem is a -----BEGIN PUBLIC KEY----- block (SubjectPublicKeyInfo — openssl rsa -in key.pem -pubout, openssl req -pubkey) or a -----BEGIN RSA PUBLIC KEY----- (PKCS#1) block; 2048–8192-bit keys.

Errors

Returns Err if public_key_pem is not a valid PEM-encoded RSA public key.

pub fn es256(public_key_pem: &str) -> Result<JwtLayer, String>

Available on crate feature auth-asymmetric only.

Create a layer that verifies ES256 JWTs against a P-256 public key.

public_key_pem must be in SubjectPublicKeyInfo PEM format (the -----BEGIN PUBLIC KEY----- block produced by, e.g., openssl ec -in key.pem -pubout).

Errors

Returns Err if public_key_pem is not a valid PEM-encoded P-256 public key.

impl JwtLayer

pub fn identity_claim(self, claim: impl Into<String>) -> JwtLayer

The claim that names the caller’s Identity (default sub; e.g. email). A token without it is still accepted, with no identity.

Trait Implementations

impl Middleware for JwtLayer

fn accepts_streamed_body( &self, _request: &Request, _connection: &ConnectionInfo, ) -> bool

Headers only: a streamed body passes through untouched.

fn handle( &self, request: &Request, connection: &ConnectionInfo, next: &dyn Application, ) -> Result<Response, String>

fn runs_inline(&self, _request: &Request, _connection: &ConnectionInfo) -> bool

true when this layer’s own work for request never blocks (in-memory state, atomics, short mutexes) — see Application::runs_inline. A WithMiddleware stack runs inline only if every layer and the inner application agree. Default false.

fn is_passthrough( &self, _request: &Request, _connection: &ConnectionInfo, ) -> bool

true when handle would do nothing for request but call next (e.g. a rate limit that isn’t configured). A WithMiddleware stack offers the inner application’s execute_async only if every layer passes the request through. Default false.

fn answers_streamed_body( &self, _request: &Request, _connection: &ConnectionInfo, ) -> bool

true when this layer answers request itself — it doesn’t call next — and reads its body as a stream (a proxy forwarding it as it arrives). The body is then streamed whatever the layers after it and the application would say. Requires accepts_streamed_body. Since 18.3.0.

fn layer_name(&self) -> &'static str

A short name for this layer, as tools that describe an app list it (Application::middleware_names): by default the type’s name without its module path or generic parameters (CacheLayer). Since 18.28.0.