axum-impl-authorization

What problem does it solve?

Prevents authorization mistakes in Axum—like converting real 404s into 401s, returning the wrong status codes, or implementing guards in a way that leaks route existence.

Core Features & Use Cases

• Correct guard placement: Uses .route_layer() for authorization so the guard runs only for matched routes, avoiding 404-to-401/403 leakage.
• Right status code semantics: Enforces the rule that failed authorization returns 403 Forbidden, while 401 Unauthorized remains the job of the authentication layer.
• Two authorization mechanisms: Supports both middleware guards (from_fn, from_fn_with_state + route_layer) for route groups and newtype guard extractors (FromRequestParts, e.g., AdminClaims) for single-handler enforcement.
• Version-aware extractor patterns: Covers Axum 0.7 and 0.8 differences for the FromRequestParts newtype implementation.

Quick Start

Use the axum-impl-authorization skill to design a role/permission guard that returns 403 on unauthorized access and is applied with .route_layer() so missing routes still produce a real 404.