axum-impl-auth-session

What problem does it solve?

This Skill solves the problem of implementing secure, version-aware, server-side session authentication in Axum without accidentally introducing session-loss, cookie insecurity, fixation vulnerabilities, or broken auth routing.

Core Features & Use Cases

• Server-side session authentication: Use opaque session IDs in cookies while storing real authentication state on the server (so restarts and multi-instance deployments can be handled safely with the right store).
• Full login system with route guards: Build typed, end-to-end authentication flows using axum-login on top of tower-sessions, including login/logout and authentication guards.
• Multiple auth decision paths: Choose between tower-sessions, axum-login, HTTP Basic (TLS-only), and OAuth2 authorization-code + PKCE, then wire it correctly per route.
• Safety-guarded best practices: Enforces critical rules like rotating session IDs on login, using Secure cookies behind TLS, validating OAuth2 state, and applying login_required using route_layer to preserve 404 semantics.

Quick Start

Use the axum-impl-auth-session skill to build a login form with OAuth2 (authorization-code + PKCE) that establishes a local tower-sessions session and protects the dashboard route with axum-login’s route guard.