{"id":16445300,"url":"https://github.com/lloydmeta/actix-jwt-authc","last_synced_at":"2025-07-19T22:04:04.816Z","repository":{"id":41571905,"uuid":"510227526","full_name":"lloydmeta/actix-jwt-authc","owner":"lloydmeta","description":"JWT authentication middleware for Actix with support for JWT invalidation and custom Claims structs.","archived":false,"fork":false,"pushed_at":"2022-07-06T09:33:58.000Z","size":1322,"stargazers_count":4,"open_issues_count":0,"forks_count":3,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-06-27T02:50:54.507Z","etag":null,"topics":["actix","actix-web","actix-web-middleware","authentication","jsonwebtoken","jwt","jwt-authentication","middleware","rust"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lloydmeta.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-07-04T05:44:25.000Z","updated_at":"2023-08-30T14:55:51.000Z","dependencies_parsed_at":"2022-08-20T08:22:23.848Z","dependency_job_id":null,"html_url":"https://github.com/lloydmeta/actix-jwt-authc","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/lloydmeta/actix-jwt-authc","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lloydmeta%2Factix-jwt-authc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lloydmeta%2Factix-jwt-authc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lloydmeta%2Factix-jwt-authc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lloydmeta%2Factix-jwt-authc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lloydmeta","download_url":"https://codeload.github.com/lloydmeta/actix-jwt-authc/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lloydmeta%2Factix-jwt-authc/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266026177,"owners_count":23866030,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["actix","actix-web","actix-web-middleware","authentication","jsonwebtoken","jwt","jwt-authentication","middleware","rust"],"created_at":"2024-10-11T09:43:57.281Z","updated_at":"2025-07-19T22:04:04.788Z","avatar_url":"https://github.com/lloydmeta.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"## actix-jwt-authc \n[![Crates.io](https://img.shields.io/crates/v/actix-jwt-authc.svg)](https://crates.io/crates/actix-jwt-authc)\n[![docs.rs](https://img.shields.io/docsrs/actix-jwt-authc.svg?label=docs.rs)](https://docs.rs/actix-jwt-authc)\n[![Continuous integration](https://github.com/lloydmeta/actix-jwt-authc/actions/workflows/ci.yaml/badge.svg)](https://github.com/lloydmeta/actix-jwt-authc/actions/workflows/ci.yaml)\n[![Coverage Status](https://coveralls.io/repos/github/lloydmeta/actix-jwt-authc/badge.svg?branch=main)](https://coveralls.io/github/lloydmeta/actix-jwt-authc?branch=main)\n\nJWT authentication middleware for Actix that supports checking for invalidated JWTs without paying the cost of a per-request\nIO call. It sources invalidated JWTs from a Stream and stores them in memory.\n\nThis middleware is based on the assumption that since JWTs (should) have an expiry, ultimately, an in-memory set of \nexplicitly-invalidated-yet-unexpired JWTs that are loaded from a stream (e.g. populated once on bootstrap, then\nupdated via diffs) should not be overwhelmingly big enough to cause problems. Only testing can truly answer if this \nassumption works for a given usecase.\n\n[Docs for `main`](https://beachape.com/actix-jwt-authc/actix_jwt_authc)\n\n### Uses\n- [Actix](https://actix.rs)\n- [jsonwebtoken](https://github.com/Keats/jsonwebtoken) for JWT encoding + validation\n\n### Features\n\n- `tracing` enables instrumentation by pulling in [tracing](https://github.com/tokio-rs/tracing)\n- `log` enables logs (via [tracing](https://github.com/tokio-rs/tracing)) using the [compatibility layer](https://docs.rs/tracing-log/latest/tracing_log/#convert-tracing-events-to-logs)\n- `session` enables [`actix-session`](https://crates.io/crates/actix-session) integration, allowing you to extract\n  JWTs from a configurable session key.\n\n### Example\n\nThe example included in this repo has\n\n- A simple set of routes for starting and inspecting the current session\n- An in-memory implementation of the invalidated JWT interface\n  - In-memory loop for purging expired JWTs from the store\n  - Channel-based Stream of invalidated JWT events for powering the invalidated JWT set used by the middleware\n- [ring](https://github.com/briansmith/ring) to generate an Ed25519 keypair for [EdDSA-signed JWTs](https://www.scottbrady91.com/jose/jwts-which-signing-algorithm-should-i-use)\n\nBoth session and JWT keys are generated on the fly, so JWTs are incompatible across restarts.\n\nIt supports `tracing`, `log` and `session` as features. To run a server on 8080:\n\n```shell\ncargo run --example inmemory --features tracing,session,log\n```\n\nSupported endpoints\n\n- `/login` to start a session\n- `/logout` to destroy the current session (requires a session)\n- `/session` to inspect the current session (requires a session)\n- `/maybe_session` to inspect the current session if it exists\n\nIf `session` is not passed, authentication in the example is dependent on `Bearer` tokens sent as an `Authorization` header.\n\n### Disclaimer\n\nTHE SOFTWARE IS PROVIDED \"AS IS\" AND THE AUTHORS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL \nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY SPECIAL, DIRECT, \nINDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN \nACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF \nTHIS SOFTWARE.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flloydmeta%2Factix-jwt-authc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flloydmeta%2Factix-jwt-authc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flloydmeta%2Factix-jwt-authc/lists"}