{"id":16096153,"url":"https://github.com/gordonsmith/rust-auth","last_synced_at":"2025-08-23T02:15:26.326Z","repository":{"id":233148419,"uuid":"692794290","full_name":"GordonSmith/rust-auth","owner":"GordonSmith","description":null,"archived":false,"fork":false,"pushed_at":"2023-09-17T15:50:41.000Z","size":4,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-05T20:31:31.512Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GordonSmith.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.MD","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-09-17T15:50:39.000Z","updated_at":"2023-09-17T15:50:44.000Z","dependencies_parsed_at":"2024-04-14T06:02:14.367Z","dependency_job_id":"99e4903b-c82f-47df-bdc2-3ced4d1d26ef","html_url":"https://github.com/GordonSmith/rust-auth","commit_stats":null,"previous_names":["gordonsmith/rust-auth"],"tags_count":0,"template":false,"template_full_name":"fastly/compute-rust-auth","purl":"pkg:github/GordonSmith/rust-auth","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GordonSmith%2Frust-auth","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GordonSmith%2Frust-auth/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GordonSmith%2Frust-auth/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GordonSmith%2Frust-auth/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GordonSmith","download_url":"https://codeload.github.com/GordonSmith/rust-auth/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GordonSmith%2Frust-auth/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":271732361,"owners_count":24811309,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-23T02:00:09.327Z","response_time":69,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-09T17:11:17.195Z","updated_at":"2025-08-23T02:15:26.294Z","avatar_url":"https://github.com/GordonSmith.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Compute@Edge OAuth application starter kit\n\nConnect to an identity provider such as Auth0 using OAuth 2.0 and validate authentication status at the Edge, to authorize access to your edge or origin hosted applications.\n\n**For more details about other starter kits for Compute@Edge, see the [Fastly developer hub](https://developer.fastly.com/solutions/starters)**\n\n## Authentication at Fastly's edge, using OAuth 2.0, OpenID Connect, and Compute@Edge\n\nThis is a self-contained Rust implementation 🦀  for the [OAuth 2.0](https://oauth.net/2/) [Authorization Code flow](https://oauth.net/2/grant-types/authorization-code/) with [Proof Key for Code Exchange (PKCE)](https://oauth.net/2/pkce/), deployed to [Compute@Edge](https://www.fastly.com/products/edge-compute/serverless/).\n\nIt includes [JSON Web Token (JWT)](https://oauth.net/2/jwt/) verification, and [access token introspection](https://oauth.net/2/token-introspection/).\n\n![A simplified flow diagram of authentication using Compute@Edge](https://user-images.githubusercontent.com/12828487/111877689-4b876500-899c-11eb-9d6c-6ecc240fa317.png)\n\nScroll down to view [the flow in more detail](#the-flow-in-detail).\n## Getting started\n\nAfter you have installed the starter kit, you'll need to do some configuration before you can deploy it, so that Fastly knows which identity provider to use and how to authenticate.\n\n### Set up an identity provider\n\nYou might operate your own identity service, but any [OAuth 2.0, OpenID Connect (OIDC) conformant provider](https://en.wikipedia.org/wiki/List_of_OAuth_providers) (IdP) will work.  You will need the following from your IdP:\n\n* A *Client ID* -\u003e Add to `src/config.toml`\n* An *OpenID Connect Discovery document* -\u003e Save as `src/well-known/openid-configuration.json`\n* A *JSON Web key set* -\u003e Save as `src/well-known/jwks.json`\n* The hostname of the IdP's *authorization server* -\u003e Create as a backend called `idp` on your Fastly service\n\nAs an example, if you are using Auth0, follow these steps after installing the starter kit:\n\n1. In the [Auth0 dashboard](https://manage.auth0.com/), choose **Create Application**. Give your app a name and choose \"Regular web application\".\n   - The *client ID* (eg. `4PWZBMqMWxnKXt1heitack0Jy2xRQP0p`) is shown next to your application name.\n1. Open `src/config.toml` in your Fastly project and paste in the `client_id` from your IdP.  Set the `nonce_secret` field to a long, non-guessable random string of your choice.  Save the file.\n1. Back in Auth0's dashboard, click **Settings**, and note down the *authorization server* hostname (eg. `dev-wna8lqtb.us.auth0.com`) is shown in the **Domain** field.\n1. In a new tab, navigate to `https://{authorization-server-hostname}/.well-known/openid-configuration`.  Save it to `src/well-known/openid-configuration.json` in your Fastly project.\n1. Open the file you just created and locate the `jwks_uri` property.  Fetch the document at that URL and save it to `src/well-known/jwks.json` in your Fastly project.\n\n### Deploy the Fastly service and get a domain\n\nNow you can build and deploy your new service:\n\n```term\n$ fastly compute publish\n```\n\nYou'll be prompted to enter the hostname of your own origin to configure the backend called `backend`, and also the authorization server of the identity provider which will be used to configure a backend called `idp`.  When the deploy is finished you'll be given a Fastly-assigned domain such as `random-funky-words.edgecompute.app`.\n### Link the identity provider to your Fastly domain\n\nAdd `https://{your-fastly-domain}/callback` to the list of allowed callback URLs in your identity provide's app configuration (In Auth0, within your application's **Settings** tab, the field is labelled **Allowed Callback URLs**).\n\nThis allows the authorization server to send the user back to the Compute@Edge service.\n\n### Try it out!\n\nNow you can visit your Fastly-assigned domain.  You should be prompted to follow a login flow with your identity provider, and then after successfully authenticating, will see content delivered from your own origin.\n\n---\n\n## The flow in detail\n\nHere is how the authentication process works:\n\n![Edge authentication flow diagram](https://user-images.githubusercontent.com/12828487/115379253-4438be80-a1c9-11eb-81af-9470e324434a.png)\n\n1. The user makes a request for a protected resource, but they have no session cookie.\n1. At the edge, this service generates:\n   * A unique and non-guessable `state` parameter, which encodes what the user was trying to do (e.g., load `/articles/kittens`).\n   * A cryptographically random string called a `code_verifier`.\n   * A `code_challenge`, derived from the `code_verifier`.\n   * A time-limited token, authenticated using the `nonce_secret`, that encodes the `state` and a `nonce` (a unique value used to mitigate replay attacks).\n1. The `state` and `code_verifier` are stored in session cookies.\n1. The service builds an authorization URL and redirects the user to the **authorization server** operated by the IdP.\n1. The user completes login formalities with the IdP directly.\n1. The IdP will include an `authorization_code` and a `state` (which should match the time-limited token we created earlier) in a post-login callback to the edge.\n1. The edge service authenticates the `state` token returned by the IdP, and verifies that the state cookie matches its subject claim.\n1. Then, it connects directly to the IdP and exchanges the `authorization_code` (which is good for only one use) and `code_verifier` for **security tokens**:\n   * An `access_token` – a key that represents the authorization to perform specific operations on behalf of the user)\n   * An `id_token`, which contains the user's profile information.\n1. The end-user is redirected to the original request URL (`/articles/kittens`), along with their security tokens stored in cookies.\n1. When the user makes the redirected request (or subsequent requests accompanied by security tokens), the edge verifies the integrity, validity and claims for both tokens. If the tokens are still good, it proxies the request to your origin.\n\n## Issues\n\nIf you encounter any non-security-related bug or unexpected behavior, please [file an issue][bug]\nusing the bug report template.\n\n[bug]: https://github.com/fastly/compute-rust-auth/issues/new?labels=bug\n\n### Security issues\n\nPlease see our [SECURITY.md](./SECURITY.md) for guidance on reporting security-related issues.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgordonsmith%2Frust-auth","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgordonsmith%2Frust-auth","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgordonsmith%2Frust-auth/lists"}