Struct AuthConfig 

#[non_exhaustive]
pub struct AuthConfig<'a> {
    pub cookie_name: &'a str,
    pub persistent_secret: Key,
    pub token_config: Option<TokenConfig>,
    pub session_expires: Option<Duration>,
    pub cookie_secure: bool,
    pub cookie_http_only: bool,
    pub cookie_same_site: Option<SameSite>,
    pub trusted_networks: Vec<CidrBlock>,
    pub strip_token_redirect: bool,
}

Configuration for AuthLayer and AuthMiddleware.

This struct is #[non_exhaustive], so new fields can be added in future releases without breaking downstream code. Construct it with AuthConfig::new (or Default::default) and then set the public fields you need rather than with a struct literal.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

cookie_name: &'a str

The cookie name

This is the name of the cookie stored in the clients’ browsers.

persistent_secret: Key

A long lived secret used to sign cookies set to the users.

The secret is not shared with users.

All issued session keys are valid as long as the persistent secret is unchanged. There is no mechanism to invalidate individual sessions.

token_config: Option<TokenConfig>

The authentication token configuration.

Set to None if the entire connection is trusted (e.g. it is on a loopback interface). In this case, token checking is disabled but SessionKey is still provided by AuthMiddleware.

session_expires: Option<Duration>

If set, issued sessions expire this long after they are issued, and the session is renewed (its expiry slid forward) once it passes the halfway point of its lifetime.

The expiry is embedded in the (signed, tamper-proof) cookie and enforced by the server, so an expired cookie stops being accepted even if the client keeps presenting it. The cookie’s browser-side Expires attribute is set to the same instant on every (re)issue. Because the expiry slides forward on use, a regularly-returning client keeps a valid session indefinitely without ever needing the token again — including past the ~400 day cap browsers place on a single cookie’s lifetime.

If None, issued sessions never expire (they remain valid as long as Self::persistent_secret is unchanged) and the cookie is a “session cookie” with no Expires attribute, saved only until the browser quits.

cookie_secure: bool

Whether the session cookie is marked Secure (sent only over HTTPS).

Defaults to false so the cookie still works over plain HTTP on a loopback interface, which is a common deployment for this crate. Set to true whenever the server is reached over HTTPS.

cookie_http_only: bool

Whether the session cookie is marked HttpOnly (hidden from client-side JavaScript, mitigating session theft via XSS).

Defaults to true; this crate never needs to read the cookie from JS.

cookie_same_site: Option<SameSite>

The SameSite attribute of the session cookie (CSRF defense).

Defaults to Some(SameSite::Strict). Use Some(SameSite::Lax) if clients must stay authenticated when following cross-site links into the app, or None to omit the attribute entirely. Note that Some(SameSite::None) implies Secure per the cookie specification.

trusted_networks: Vec<CidrBlock>

Client networks that are trusted to have already authenticated the peer, so a request from one is accepted without a token (as if Self::token_config were None for that client).

This is for deployments fronted by a trusted overlay network — e.g. Tailscale (100.64.0.0/10) or a WireGuard subnet — where the overlay authenticates and encrypts the peer connection, making an application token redundant. The client’s address is taken from the ConnectInfo<SocketAddr> request extension, so the server must be run with into_make_service_with_connect_info for this to take effect; if the extension is absent the client is treated as untrusted.

Defaults to empty (no overlay trust). Note that the address checked is the immediate TCP peer, so this must not include ranges that could be spoofed via an intermediate reverse proxy.

strip_token_redirect: bool

When a browser navigation authenticates with a token in the query string, reply with a redirect to the same location minus the token parameter, so the token does not linger in the address bar, browser history, or Referer headers.

Only top-level navigations (a GET whose Accept header includes text/html) are redirected, so programmatic clients that authenticate with a token on every request are unaffected. Defaults to true.

Implementations

impl AuthConfig<'_>

pub fn new(persistent_secret: Key) -> Self

Create a configuration with the given persistent secret and the default value for every other field.

Because AuthConfig is #[non_exhaustive], downstream crates cannot build it with a struct literal; start here (or from Default::default) and set the public fields you need:

use axum_token_auth::{AuthConfig, Key, TokenConfig};
let mut cfg = AuthConfig::new(Key::generate());
cfg.token_config = Some(TokenConfig::new("token"));
let layer = cfg.into_layer();

pub fn into_layer(self) -> AuthLayer

Convert Self to an AuthLayer.

pub fn generate_token(&self, ttl: Duration) -> String

Mint a self-expiring authentication token valid for ttl from now.

The returned string is the value to place in the TokenConfig::name query parameter of the initial URL handed to the user out-of-band. It is signed with Self::persistent_secret and carries its own expiry, so the server validates it without storing anything. Prefer a short ttl: a token only needs to live long enough for the first request, after which the client holds a session cookie. An absurdly large ttl saturates at the maximum representable expiry rather than panicking.

Trait Implementations

impl<'a> Clone for AuthConfig<'a>

fn clone(&self) -> AuthConfig<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Debug for AuthConfig<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthConfig<'_>

fn default() -> Self

Returns the “default value” for a type.