Module auth 

Bearer-token authentication, rate limiting, and security middlewares.

Structs

AuthState

Shared authentication state holding the optional Bearer token for the MCP server.

RateLimiterState

Lock-free token-bucket rate limiter using monotonic timestamps for smooth refill.

Functions

constant_time_eq

Constant-time byte comparison to prevent timing side-channel attacks on token validation.

default_rate_limiter

Create a rate limiter with the default capacity of DEFAULT_RATE_LIMIT requests per second.

dns_rebinding_guard

Axum middleware that blocks DNS rebinding attacks.

generate_token

Generate a random UUID v4 token suitable for Bearer authentication.

is_allowed_origin

Returns true if origin (from the HTTP Origin header) is an http/https localhost origin.

is_localhost_host

Returns true if host (from the HTTP Host header) resolves to a localhost address.

origin_guard

Axum middleware that blocks requests a web page made a browser send.

rate_limit

Axum middleware that rejects requests with 429 when the token bucket is exhausted.

require_auth

Axum middleware that validates the Authorization: Bearer <token> header against AuthState.

security_headers

Axum middleware that sets security-hardening response headers on every response.