Struct GuardLayer 

pub struct GuardLayer<St, S> { /* private fields */ }

Available on crate feature axum only.

Tower layer that authenticates requests with a Guard. Create it with Guard::layer.

Per request, the service:

1. Passes the request to the inner service untouched when a bypass matches (bypass_bearer_prefixes, bypass_when): no authentication, no AuthSession, no added headers.
2. Reads the peer address from ConnectInfo<SocketAddr>. When it is missing the request fails closed with 500, because the app was not served with into_make_service_with_connect_info::<SocketAddr>().
3. Builds the ClientContext with Guard::client_context and authenticates the session cookie. A missing cookie is not_authenticated.
4. On success, inserts the AuthSession into the request extensions, calls the inner service, appends the rotated token’s Set-Cookie when the token was rotated, and sets Cache-Control: no-store, replacing any Cache-Control the handler set: authenticated responses must never be cached by shared caches or the browser.
5. On rejection, answers with rejection_response; on a guard error, with 500 {"error":"internal"}.

Works with both Router::layer and Router::route_layer. Cheap to clone.

Implementations

impl<St, S> GuardLayer<St, S>

pub fn with(self, checks: Checks) -> Self

Authenticates with checks through Guard::authenticate_with instead of the guard’s configured checks, e.g. Checks::strict for sensitive routes. The session’s baseline learns only the signals checks scored.

Without this, the layer calls Guard::authenticate with the configured checks.

pub fn require_recent_auth(self, max_age: Duration) -> Self

Rejects authenticated requests whose subject last proved who they are more than max_age ago with 401 step_up_required (see Guard::requires_reauth).

The session is not changed and the cookie is kept; a token rotated by the same request is still delivered. Complete the step-up with Guard::complete_step_up to refresh authenticated_at.

The window must leave room for the retry after the step-up: with a zero max_age that retry is already too late, so the route can never be reached. To confirm every single action (deleting an account, say), verify the credential in that request’s handler instead, or use a short window such as two minutes.

pub fn bypass_bearer_prefixes<I, P>(self, prefixes: I) -> Self

where I: IntoIterator<Item = P>, P: Into<String>,

Passes requests whose Authorization: Bearer <token> starts with one of prefixes to the inner service untouched, for API keys handled by other middleware. Empty prefixes are ignored. Calls add to the list.

pub fn bypass_when<F>(self, predicate: F) -> Self

where F: Fn(&HeaderMap) -> bool + Send + Sync + 'static,

Passes requests for which predicate returns true to the inner service untouched. Calls add predicates; any match bypasses.

Trait Implementations

impl<St, S> Clone for GuardLayer<St, S>

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<St, S> Debug for GuardLayer<St, S>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<I, St, S> Layer<I> for GuardLayer<St, S>

type Service = GuardService<I, St, S>

The wrapped service

fn layer(&self, inner: I) -> Self::Service

Wrap the given service with the middleware, returning a new service that has been decorated with the middleware.