Quick demo of a REST frontend with a Redis session store.

Michael de Silva

Last update: Dec 31, 2022

Related tags

Web programming axum-rest-starter-example

Overview

axum-rest-starter-example

Important Tasks

Ensure session UUID is unique
Protect /api/ with JWT
Add CSRF
CORS?

Dev Setup

(1) Run docker compose up to fire up a local Redis server on port 6400.

(2) Create conf/development/config.yml with the following defaults

---
jwt_secret: "resetme"
redis_host_name: "127.0.0.1"
redis_password: replaceme
redis_session_db: 0
redis_port: 6400

(3) Run rustup update and rustup override set stable within the root of the project. You can also run cargo build.

(4) Run DOMAIN=localhost cargo run to run the Axum frontend and visit http://localhost:3000

The domain value set above is used for the session cookie.

API

Any API requests made locally need a valid cookie persisted in Redis. You can simply visit http://localhost:3000 and fetch the cookie value from STDOUT or from a browser debugging console

Frontend

POST /api/v1/drops/drop_id/registrations

curl --location --request POST 'localhost:3000/api/v1/drops/2/registrations' \
--header 'Content-Type: application/json' \
--header 'Cookie: axum-session=AQ+nalsDoBvb3shGpgZA9PVl6aiHivAdB6p3mxMkn3mGn6VZGGzQuIUDlyjdfp2/Qjf96HsHkeLNy/vHVTEMdA==' \
--data-raw '{
  "raffle": {
    "agree_to_join": true,
    "accept_privacy_policy": true
  },
  "registration_form": {
    "firstname": "",
    "lastname": "",
    "address_line1": "",
    "address_line2": "",
    "address_number": "",
    "postcode": "",
    "city": "",
    "state": "",
    "phone_number": "",
    "email": "",
  }
}'

API JWT

/api is protected

For this test, /api/protected is just a testing path. If the client has no valid cookie, the REST middleware layer will return a new cookie. JWT auth sits in top of this, hence the basic session cookie still needs to be provided.

curl --location --request GET 'localhost:3000/api/protected/' \                                                                                        13:45:27
                          --header 'Cookie: axum-session=AQ+nalsDoBvb3shGpgZA9PVl6aiHivAdB6p3mxMkn3mGn6VZGGzQuIUDlyjdfp2/Qjf96HsHkeLNy/vHVTEMdA==' \
                          --header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiQGIuY29tIiwiY29tcGFueSI6IkFDTUUiLCJleHAiOjEwMDAwMDAwMDAwfQ.M3LAZmrzUkXDC1q
5mSzFAs_kJrwuKz3jOoDmjJ0G4gM'
{"error":"Invalid token!"}

/authorize

Notice the JSON data required to obtain an auth token. The client_id and client_secret are set as application configuration secrets (optionally, these can be stored in the DB if we wish).

curl --location --request POST 'localhost:3000/authorize' \                                                                                            13:45:57
                          --header 'Cookie: axum-session=AQ+nalsDoBvb3shGpgZA9PVl6aiHivAdB6p3mxMkn3mGn6VZGGzQuIUDlyjdfp2/Qjf96HsHkeLNy/vHVTEMdA==' \
                          --header 'Content-Type: application/json' \
                          --data-raw '{
                          "client_id": "foo",
                          "client_secret": "bar"
                      }'
{"access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiQGIuY29tIiwiY29tcGFueSI6IkFDTUUiLCJleHAiOjEwMDAwMH0.riR9JGJyrgPWbfIsgs1rQyQulAjSezF72ex0hLtp7P4","token_type":"Bearer"}

Any /api path with a valid token

Ensure the JWT token expiration is set correctly, by default we are setting it as 1 hour.

curl --location --request GET 'localhost:3000/api/protected/' \                                                                                        14:33:26
                          --header 'Cookie: axum-session=AQ+nalsDoBvb3shGpgZA9PVl6aiHivAdB6p3mxMkn3mGn6VZGGzQuIUDlyjdfp2/Qjf96HsHkeLNy/vHVTEMdA==' \
                          --header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiQGIuY29tIiwiY29tcGFueSI6IkFDTUUiLCJleHAiOjE2NDI1ODY2MDZ9._uA7XhkcblejqGAGJ
a0ZjLNJ3IxLER_jlPVL3HInCCc'
Welcome to the protected area :)

MSRV

This project is tested agains the most recent stable rust version.

You might also like...

Print Apple WeatherKit REST API weather conditions and hourly/daily foreacast to the console.

Comments

Use `async-redis-session`

It should be noted that async-redis-session is no longer being maintained (properly) and relies on an older version of the redis crate.

Therefore I've attempted to vendor this, but it's internal code remains untested, until this PR is ready.
enhancement

opened by bsodmike 0