repository·master·Indexed 21 days ago
https://github.com/197g/oxide-authA modular OAuth2 server library for Rust (v0.6.1) featuring a trait-based interface for managing tokens. It is designed to be server-agnostic with configurable and pluggable backends, providing official integration crates for web frameworks including actix-web, axum, rocket, poem, iron, and rouille, as well as async/await and redis support.
oxide-auth-poem crate provides integration between the oxide-auth authentication framework and the poem web server library. This allows you to use oxide-auth's authentication logic within a Poem-based web application.oxide-auth-rouille crate provides integration between the oxide-auth authentication framework and the rouille web server library. This allows you to implement authentication flows within a Rouille-based web application.oxide-auth-axum provides integration between the oxide-auth authentication framework and the axum web server library. This allows you to use oxide-auth's authentication logic within Axum-based web applications.oxide-auth-rocket crate provides integration between the oxide-auth authentication framework and the rocket web server library. This allows you to use oxide-auth's authentication logic within a Rocket-based application.oxide-auth-async crate provides integration for the core oxide-auth library, allowing you to use its authentication logic within async fn contexts and with Rust futures.oxide-auth-iron crate provides integration between the oxide-auth authentication framework and the iron web server library. This allows you to use oxide-auth's authentication logic within an Iron-based web application.oxide-auth-actix crate provides integration between the core oxide-auth library and the actix-web framework. It allows you to leverage the actor model and web request handling of actix-web to implement authentication flows provided by oxide-auth.While the core oxide-auth crate is server-agnostic, several extension crates provide idiomatic wrappers for popular Rust web frameworks and database backends. These extensions implement the necessary oxide-auth traits for request types, errors, and responses specific to those frameworks.
| Target | Crate | Notes |
|---|---|---|
actix | oxide-auth-actix | |
async wrappers | oxide-auth-async | |
redis | oxide-auth-db | |
rocket | oxide-auth-rocket | Requires nightly |
rouille | oxide-auth-rouille | |
iron | oxide-auth-iron | |
poem | oxide-auth-poem | |
axum | oxide-auth-axum | (Available in repository) |
In oxide-auth, a Scope is a set of space-separated tokens. Scopes follow a partial ordering logic based on conjunction: a scope is considered a subset of another if all its tokens are present in the other scope.
Scope (the resource_scope).Scope (the grant_scope).resource_scope is a subset of the grant_scope (i.e., resource_scope <= grant_scope).| Operation | Meaning | Logic |
|---|---|---|
resource_scope.allow_access(&grant_scope) | Can the resource allow this grant? | resource_scope <= grant_scope |
grant_scope.priviledged_to(&resource_scope) | Does the grant have enough privilege for the resource? | resource_scope <= grant_scope |
Note that if scopes contain incomparable tokens (e.g., A B vs A C), they are not considered subsets of each other.
```rust
use oxide_auth::primitives::scope::Scope;
let grant_scope = "some_scope other_scope".parse::<Scope>().unwrap();
let resource_scope = "some_scope".parse::<Scope>().unwrap();
let uncomparable = "some_scope third_scope".parse::<Scope>().unwrap();
// Access granted because resource_scope is a subset of grant_scope
assert!(resource_scope.allow_access(&grant_scope));
assert!(grant_scope.priviledged_to(&resource_scope));
// Access denied because tokens are incomparable
assert!(!uncomparable.allow_access(&grant_scope));
```埋DBRegistrar is a database-backed implementation of the Registrar trait from oxide-auth. It manages the storage, retrieval, and validation of OAuth2 clients using a DataSource (repository).
Key features:
Client objects by encoding them with a PasswordPolicy (defaults to Argon2).set_password_policy.bound_redirect for URI validation, negotiate for pre-grant generation, and check for client authentication.To use DBRegistrar, you must provide a connection URL, a maximum pool size, and a client prefix for your database keys.
use oxide_auth::primitives::registrar::{Client, Registrar};
// Note: DBRegistrar requires a DataSource implementation (e.g., Redis via the oxide-auth-db crate)
let mut registrar = DBRegistrar::new(
"redis://localhost/0".to_string(),
32,
"client:".to_string()
).unwrap();When registering redirect URIs, you can choose between different matching behaviors using the RegisteredUrl enum:
Exact(ExactUrl): Requires a literal, character-for-character match of the string. Useful for preventing injection of unexpected query parameters.Semantic(Url): Uses standard URL semantic matching (e.g., normalization).IgnorePortOnLocalhost(IgnoreLocalPortUrl): Matches the URL semantically but ignores the port number if the host is localhost. This follows IETF recommendations for local development.pub enum RegisteredUrl {
Exact(ExactUrl),
Semantic(Url),
IgnorePortOnLocalhost(IgnoreLocalPortUrl),
}