Broken Authentication in Axum

Fixing broken authentication in Axum involves leveraging its extractor system and middleware correctly. First, avoid optional extractors (Option) for authentication—use mandatory ones and let Axum return 401 automatically on failure. For JWT validation, create a custom extractor that validates tokens rigorously. Example:

use axum::extract::FromRequest;
use axum::http::Request;
use jsonwebtoken::{decode, DecodingKey, Validation};

#[derive(Debug)]
struct AuthUser(pub String); // user ID or claims

#[async_trait]
impl FromRequest for AuthUser
where
    S: Send + Sync,
{
    type Rejection = (axum::http::StatusCode, &'static str);

    async fn from_request(req: Request, state: &S) -> Result {
        let token = req
            .headers()
            .get(axum::http::header::AUTHORIZATION)
            .and_then(|h| h.to_str().ok())
            .and_then(|h| h.strip_prefix("Bearer "))
            .ok_or_else(|| (axum::http::StatusCode::UNAUTHORIZED, "Missing token"))?;

        let claims = decode::(token, &DecodingKey::from_secret("secret".as_ref()), &Validation::default())
            .map_err(|_| (axum::http::StatusCode::UNAUTHORIZED, "Invalid token"))?;

        Ok(AuthUser(claims.claims.sub))
    }
}

// Usage in route:
async fn protected_handler(user: AuthUser) -> &'static str {
    "Welcome, " + &user.0
}

let app = Router::new()
    .route("/protected", get(protected_handler));

This ensures token presence, format, signature, and claims are validated before the handler runs. Additionally, apply authentication middleware globally via Router::layer to enforce consistency. middleBrick’s Pro plan offers continuous monitoring to detect regressions—e.g., if a developer later removes the extractor or weakens validation, scheduled scans alert the team before deployment.