Rust Web身份验证库axum-login的使用：为Axum框架提供安全便捷的登录和会话管理功能

axum-login是一个为Axum框架提供用户识别、认证和授权的tower中间件库。

主要特性

• 用户识别、认证和授权：通过AuthSession轻松管理认证和授权，它也是一个提取器，可以直接在Axum处理器中使用
• 支持任意用户和后端：应用实现AuthUser和AuthnBackend特性，支持任何用户类型和用户管理后端
• 用户和组权限：通过AuthzBackend特性支持授权，允许应用定义自定义权限
• 便捷的路由保护：通过login_required和permission_required宏提供中间件保护路由访问
• 可靠的会话管理：使用tower-sessions进行高性能且符合人体工程学的会话管理

安装

在Cargo.toml中添加依赖：

[dependencies]
axum-login = "0.18.0"

使用示例

以下是使用axum-login的完整示例demo：

use axum::{
    routing::get,
    Router,
    response::IntoResponse,
    extract::FromRef,
};
use axum_login::{
    login_required,
    AuthManagerLayerBuilder,
    AuthUser,
    AuthnBackend,
    UserId,
};
use serde::{Deserialize, Serialize};
use std::sync::Arc;
use tokio::sync::RwLock;

// 定义用户类型
#[derive(Debug, Clone, Serialize, Deserialize)]
struct User {
    id: i64,
    name: String,
    password: String,
}

impl AuthUser for User {
    type Id = i64;

    fn id(&self) -> Self::Id {
        self.id
    }

    fn session_auth_hash(&self) -> &[u8] {
        self.password.as_bytes()
    }
}

// 定义认证后端
#[derive(Debug, Clone)]
struct Backend {
    users: Arc<RwLock<Vec<User>>>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
struct Credentials {
    username: String,
    password: String,
}

#[derive(Debug, thiserror::Error)]
enum AuthError {
    #[error("invalid credentials")]
    InvalidCredentials,
}

impl AuthnBackend for Backend {
    type User = User;
    type Credentials = Credentials;
    type Error = AuthError;

    async fn authenticate(
        &self,
        creds: Self::Credentials,
    ) -> Result<Option<Self::User>, Self::Error> {
        let users = self.users.read().await;
        
        for user in users.iter() {
            if user.name == creds.username && user.password == creds.password {
                return Ok(Some(user.clone()));
            }
        }
        
        Ok(None)
    }

    async fn get_user(
        &self,
        user_id: &UserId<Self>,
    ) -> Result<Option<Self::User>, Self::Error> {
        let users = self.users.read().await;
        Ok(users.iter().find(|u| u.id == *user_id).cloned())
    }
}

// 定义应用状态
#[derive(Debug, Clone, FromRef)]
struct AppState {
    backend: Backend,
}

#[tokio::main]
async fn main() {
    // 初始化用户数据库
    let users = Arc::new(RwLock::new(vec![
        User {
            id: 1,
            name: "alice".to_string(),
            password: "password123".to_string(),
        },
    ]));
    
    let backend = Backend { users };
    
    // 构建认证管理中间件
    let auth_layer = AuthManagerLayerBuilder::new(backend.clone(), || async move {
        // 会话过期时间配置
        Some(3600)
    }).build();
    
    let app = Router::new()
        .route("/", get(handler))
        .route("/protected", get(protected_handler))
        .layer(auth_layer)
        .with_state(AppState { backend });
    
    let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await.unwrap();
    axum::serve(listener, app).await.unwrap();
}

async fn handler() -> impl IntoResponse {
    "Hello, World!"
}

#[login_required]
async fn protected_handler() -> impl IntoResponse {
    "Protected content!"
}

安全保证

这个crate使用#![forbid(unsafe_code)]确保所有实现都是100%安全的Rust代码。

完整示例代码

以下是一个更完整的示例，包含登录/注销功能：

use axum::{
    extract::State,
    Form,
    response::{IntoResponse, Redirect},
    routing::{get, post},
    Router,
};
use axum_login::{
    auth_session::{AuthSession, LoginGuard},
    AuthManagerLayerBuilder,
    AuthUser,
    AuthnBackend,
    UserId,
};
use serde::{Deserialize, Serialize};
use std::sync::Arc;
use tokio::sync::RwLock;

// 1. 定义用户类型
#[derive(Debug, Clone, Serialize, Deserialize)]
struct User {
    id: i64,
    name: String,
    password: String,
    email: String,
}

impl AuthUser for User {
    type Id = i64;

    fn id(&self) -> Self::Id {
        self.id
    }

    fn session_auth_hash(&self) -> &[u8] {
        self.password.as_bytes()
    }
}

// 2. 定义认证后端
#[derive(Debug, Clone)]
struct Backend {
    users: Arc<RwLock<Vec<User>>>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Credentials {
    pub username: String,
    pub password: String,
}

#[derive(Debug, thiserror::Error)]
pub enum AuthError {
    #[error("invalid credentials")]
    InvalidCredentials,
    #[error("user not found")]
    UserNotFound,
}

#[axum::async_trait]
impl AuthnBackend for Backend {
    type User = User;
    type Credentials = Credentials;
    type Error = AuthError;

    async fn authenticate(
        &self,
        creds: Self::Credentials,
    ) -> Result<Option<Self::User>, Self::Error> {
        let users = self.users.read().await;
        
        let user = users
            .iter()
            .find(|user| user.name == creds.username && user.password == creds.password);
        
        Ok(user.cloned())
    }

    async fn get_user(
        &self,
        user_id: &UserId<Self>,
    ) -> Result<Option<Self::User>, Self::Error> {
        let users = self.users.read().await;
        let user = users.iter().find(|user| user.id == *user_id);
        Ok(user.cloned())
    }
}

// 3. 定义应用状态
#[derive(Clone, FromRef)]
struct AppState {
    backend: Backend,
}

// 4. 处理器函数
async fn login(
    mut auth_session: AuthSession<Backend>,
    State(state): State<AppState>,
    Form(creds): Form<Credentials>,
) -> impl IntoResponse {
    let user = match auth_session.authenticate(creds).await {
        Ok(Some(user)) => user,
        Ok(None) => return Err(AuthError::InvalidCredentials),
        Err(_) => return Err(AuthError::InvalidCredentials),
    };

    auth_session.login(&user).await.unwrap();
    
    Redirect::to("/dashboard").into_response()
}

async fn logout(mut auth_session: AuthSession<Backend>) -> impl IntoResponse {
    auth_session.logout().await;
    Redirect::to("/login").into_response()
}

async fn dashboard(LoginGuard(user): LoginGuard<User>) -> impl IntoResponse {
    format!(
        "欢迎回来，{}! 你的用户ID是: {}",
        user.name, user.id
    )
}

async fn login_page() -> impl IntoResponse {
    r#"
    <!doctype html>
    <html>
        <head>
            <title>登录</title>
        </head>
        <body>
            <h1>登录</h1>
            <form action="/login" method="post">
                <div>
                    <label>用户名:
                        <input type="text" name="username" placeholder="输入用户名">
                    </label>
                </div>
                <div>
                    <label>密码:
                        <input type="password" name="password" placeholder="输入密码">
                    </label>
                </div>
                <button type="submit">登录</button>
            </form>
        </body>
    </html>
    "#
}

// 5. 主函数
#[tokio::main]
async fn main() {
    // 初始化用户数据库
    let users = Arc::new(RwLock::new(vec![
        User {
            id: 1,
            name: "alice".to_string(),
            password: "password123".to_string(),
            email: "alice@example.com".to_string(),
        },
        User {
            id: 2,
            name: "bob".to_string(),
            password: "password456".to_string(),
            email: "bob@example.com".to_string(),
        },
    ]));

    let backend = Backend { users };
    
    // 构建认证管理中间件
    let auth_layer = AuthManagerLayerBuilder::new(backend.clone(), || async move {
        Some(3600) // 会话过期时间(秒)
    }).build();

    let app = Router::new()
        .route("/", get(|| async { Redirect::to("/login") }))
        .route("/login", get(login_page))
        .route("/login", post(login))
        .route("/logout", get(logout))
        .route("/dashboard", get(dashboard))
        .layer(auth_layer)
        .with_state(AppState { backend });

    println!("服务器运行在 http://localhost:3000");
    let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await.unwrap();
    axum::serve(listener, app).await.unwrap();
}

安全保证

这个crate使用#![forbid(unsafe_code)]确保所有实现都是100%安全的Rust代码。