Rust · axum · actix-web · Rocket · warp · poem
Session middleware, an AuthContext extractor, a require_auth gate, and a logout handler for Rust backends, with dedicated crates for axum, actix-web, Rocket, warp, and poem on a shared authdog-core. Validate Authdog sessions on every request, on the same wire as the Node SDKs.
Wire the middleware
// main.rs
let authdog = Authdog::new(&pk).expect("invalid public key");
let app = Router::new()
.route("/me", get(me).layer(from_fn(require_auth)))
.layer(from_fn_with_state(authdog.clone(), attach_session));
Read the session as an extractor
// handlers.rs
async fn me(ctx: AuthContext) -> Json<Value> {
Json(ctx.user.unwrap_or(Value::Null))
}
Idiomatic per framework, one core
Session middleware, an extractor, and a require_auth gate, delivered as a dedicated crate for axum, actix-web, Rocket, warp, or poem.
authdog-axum, authdog-actix, authdog-rocket, authdog-warp, and authdog-poem each wrap the shared authdog-core idiomatically, with middleware and extractors that surface token, user, and is_authenticated.
Layer require_auth on protected routes and axum responds 401 for unauthenticated requests before your handler runs. This is the security boundary.
Authdog::new parses and validates the public key once at boot, so a malformed or untrusted key errors immediately instead of at the first request.
Build with .fetch_user(false) for high-throughput services that validate tokens elsewhere, and supply your own reqwest client when you need to.
attach_session reads the authdog-session cookie or an Authorization: Bearer header directly, and logout expires the cookie with HttpOnly and SameSite=Lax.
It mirrors @authdog/express and @authdog/fastify on the wire, so one Authdog environment serves your Node and Rust services interchangeably.
Depend on the crate for your framework, e.g. authdog-axum.
Attach attach_session at the router root.
Layer require_auth on the routes you protect.
Add the crate for your framework, wire the middleware, and gate your routes with require_auth today. Free to start, with secure defaults built in.