Authorization and Authentication in Rust: A Complete Guide

Authorization and Authentication in Rust: A Complete Guide for Developers

Rust is a systems programming language gaining popularity for building high-load and secure web services. However, implementing authentication (identity verification) and authorization (access rights verification) in Rust requires a special approach due to its strict type system and lack of built-in solutions. In this article, we will cover key libraries and practical examples.

Why Rust for Authentication?

Security is Rust's top priority. The compiler prevents memory leaks, data races, and many vulnerabilities common in C/C++. However, implementing authentication manually can lead to errors, so the community has created several mature libraries.

Key Libraries for Authentication in Rust

1. actix-web-httpauth — for the Actix-web framework

The most popular library for implementing HTTP authentication (Basic, Bearer, Digest) in the Actix-web ecosystem.

2. jsonwebtoken — working with JWT

A full-featured implementation of JSON Web Tokens (JWT) for Rust. Supports RS256, HS256, ES256, and other algorithms.

3. bcrypt — password hashing

A reliable library for hashing passwords using the bcrypt algorithm with automatic salt generation.

4. argon2 — modern hashing

If bcrypt seems outdated, use Argon2 — the winner of the Password Hashing Competition.

5. tower-http — middleware for authorization

Allows creating reusable middleware for access rights verification in any HTTP server based on Tower.

Practical Example: JWT Authentication in Actix-web

Let's look at a minimal server example with registration and login. First, add dependencies to Cargo.toml:

[dependencies]actix-web = "4"actix-web-httpauth = "0.8"jsonwebtoken = "9"bcrypt = "0.15"serde = { version = "1", features = ["derive"] }tokio = { version = "1", features = ["full"] }

Now let's write the user structure and functions for creating/verifying JWT:

use actix_web::{web, App, HttpServer, HttpResponse, HttpRequest};use actix_web_httpauth::extractors::bearer::BearerAuth;use jsonwebtoken::{encode, decode, Header, Validation, EncodingKey, DecodingKey};use bcrypt::{hash, verify, DEFAULT_COST};use serde::{Serialize, Deserialize};

#[derive(Debug, Serialize, Deserialize)]struct Claims {    sub: String, // user email    exp: usize,  // token expiration time}

#[derive(Debug, Serialize, Deserialize)]struct User {    email: String,    password_hash: String,}

// User storage (in reality — database)static USERS: once_cell::sync::Lazy<std::sync::Mutex<Vec<User>>> =    once_cell::sync::Lazy::new(|| std::sync::Mutex::new(vec![]));

async fn register(info: web::Json<UserInput>) -> HttpResponse {    let hashed = hash(&info.password, DEFAULT_COST).unwrap();    let user = User {        email: info.email.clone(),        password_hash: hashed,    };    USERS.lock().unwrap().push(user);    HttpResponse::Ok().json("User registered")}

async fn login(info: web::Json<UserInput>) -> HttpResponse {    let users = USERS.lock().unwrap();    if let Some(user) = users.iter().find(|u| u.email == info.email) {        if verify(&info.password, &user.password_hash).unwrap() {            let claims = Claims {                sub: info.email.clone(),                exp: 10000000000,            };            let token = encode(                &Header::default(),                &claims,                &EncodingKey::from_secret(b"secret_key"),            ).unwrap();            return HttpResponse::Ok().json(token);        }    }    HttpResponse::Unauthori