rust 56 lines · 8 steps

How a JWT extractor works in Axum

A custom FromRequestParts implementation turns a Bearer token into a typed CurrentUser handlers can request directly.

Explained by highlit

Axum Intermediate authentication jwt extractors error-handling middleware

1use axum::{
2    extract::FromRequestParts,
3    http::{request::Parts, StatusCode, header::AUTHORIZATION},
4};
5use jsonwebtoken::{decode, DecodingKey, Validation};
6use serde::Deserialize;
7use uuid::Uuid;
8 
9#[derive(Debug, Clone)]
10pub struct CurrentUser {
11    pub id: Uuid,
12    pub email: String,
13}
14 
15#[derive(Deserialize)]
16struct Claims {
17    sub: Uuid,
18    email: String,
19}
20 
21pub struct AuthError(StatusCode, &'static str);
22 
23impl axum::response::IntoResponse for AuthError {
24    fn into_response(self) -> axum::response::Response {
25        (self.0, self.1).into_response()
26    }
27}
28 
29impl<S> FromRequestParts<S> for CurrentUser
30where
31    S: Send + Sync,
32{
33    type Rejection = AuthError;
34 
35    async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self, Self::Rejection> {
36        let header = parts
37            .headers
38            .get(AUTHORIZATION)
39            .and_then(|v| v.to_str().ok())
40            .ok_or(AuthError(StatusCode::UNAUTHORIZED, "missing authorization header"))?;
41 
42        let token = header
43            .strip_prefix("Bearer ")
44            .ok_or(AuthError(StatusCode::UNAUTHORIZED, "invalid scheme"))?;
45 
46        let key = DecodingKey::from_secret(std::env::var("JWT_SECRET").unwrap().as_bytes());
47        let claims = decode::<Claims>(token, &key, &Validation::default())
48            .map_err(|_| AuthError(StatusCode::UNAUTHORIZED, "invalid token"))?
49            .claims;
50 
51        Ok(CurrentUser {
52            id: claims.sub,
53            email: claims.email,
54        })
55    }
56}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1Implementing FromRequestParts lets a type become a first-class handler argument that Axum resolves automatically.
2Returning a typed Rejection that implements IntoResponse keeps auth failures as clean HTTP responses.
3Validating credentials inside the extractor centralizes auth so individual handlers stay free of token-parsing logic.

Related explainers

javascript

const ROLE_PERMISSIONS = {
  admin: ['users:read', 'users:write', 'billing:read', 'billing:write'],
  manager: ['users:read', 'billing:read'],
  member: ['users:read'],

Role-based permissions middleware in Express

authorization middleware rbac

Intermediate 9 steps

rust

use axum::{extract::{Path, State}, http::StatusCode, Json};
use dashmap::DashMap;
use serde::Serialize;
use std::sync::Arc;

Request coalescing in an Axum handler

caching concurrency request-coalescing

Advanced 8 steps

ruby

class TemplateInterpolator
  PLACEHOLDER = /\{\{\s*([\w.]+)\s*\}\}/
 
  def initialize(strict: false)

Interpolating templates with dotted keys in Ruby

regex string-interpolation hash-traversal

Intermediate 6 steps

package config
 
import (
	"fmt"

A thread-safe config singleton in Go

singleton concurrency environment-variables

Intermediate 7 steps

rust

use std::net::Ipv4Addr;
use std::str::FromStr;
 
#[derive(Debug, Clone, Copy)]

Parsing and matching IPv4 CIDR ranges in Rust

bitwise-operations parsing error-handling

Intermediate 8 steps

javascript

const express = require('express');
const app = express();
 
app.get('/health', (req, res) => res.json({ status: 'ok' }));

Graceful shutdown in an Express server

graceful-shutdown signal-handling connection-tracking

Advanced 9 steps

Share this explainer

Here's the card — post it anywhere.

How a JWT extractor works in Axum — share card

Made with highlit — turn any snippet into a walkthrough like this in about a minute.

Explain your code