Is there a good way to implement an authentication / authorization check at the Actix route level?

Question

My API routes are collected into a scope like so:

.scope("/api", |s| s
        .nested("/doorlock", routes::doorlock)
        .resource("/config{path:.*}", |r| {
            r.get().with(routes::config::read);
            r.put().with(routes::config::write);
            r.delete().with(routes::config::delete);
        })
)

I am thinking about adding a route-level protection, something that would either pass-through or return a 401 Unauthorizated response like so:

.scope("/api", |s| s
        .filter(is_authenticated_and_authorized)
        .nested("/doorlock", routes::doorlock)
        .resource("/config{path:.*}", |r| {
            r.get().with(routes::config::read);
            r.put().with(routes::config::write);
            r.delete().with(routes::config::delete);
        })
)

Unfortunately, this will forward requests to the default handler rather than returning an error response in case it does not match.

belst · Accepted Answer · 2018-09-15T12:03:59.597

2

What you are looking for is middleware.

You can then add your middleware to the scope:

// Create middleware
struct AuthMiddleware;

impl Middleware<AppState> for AuthMiddleware {
    fn start(&self, req: &mut HttpRequest<AppState>) -> Result<Started> {
        unimplemented!() // implement your auth logic here
    }
}

// later:

App::with_state(my_state)
    .scope("/api", |s| s
        .middleware(AuthMiddleware) // add your middleware to the scope
        .nested("/doorlock", routes::doorlock)
        .resource("/config{path:.*}", |r| {
            r.get().with(routes::config::read);
            r.put().with(routes::config::write);
            r.delete().with(routes::config::delete);
        })
);

edited Sep 15 '18 at 12:03

answered Jul 18 '18 at 23:25

belst

2,285
2
20
22

2

It's worth mentioning the any extracted information in the Middleware can be "saved" into the request using the `.extensions()` map. – Ákos Vandra-Meyer Jul 22 '18 at 17:04
Adding middleware to a scope is really helpful to know--from the actix docs, I wasn't aware you could add it in to any level beside the root/app level. – turboladen Dec 12 '18 at 17:51
Note: This answer doesn't apply anymore on actix 4.x+ – Ankush Dec 29 '22 at 07:28

Is there a good way to implement an authentication / authorization check at the Actix route level?

1 Answers1