rust 56 lines · 8 steps

How a JWT extractor works in Axum

A custom FromRequestParts implementation turns a Bearer token into a typed CurrentUser handlers can request directly.

Explained by highlit
Axum Intermediate authentication jwt extractors error-handling middleware
1use axum::{
2 extract::FromRequestParts,
3 http::{request::Parts, StatusCode, header::AUTHORIZATION},
4};
5use jsonwebtoken::{decode, DecodingKey, Validation};
6use serde::Deserialize;
7use uuid::Uuid;
8 
9#[derive(Debug, Clone)]
10pub struct CurrentUser {
11 pub id: Uuid,
12 pub email: String,
13}
14 
15#[derive(Deserialize)]
16struct Claims {
17 sub: Uuid,
18 email: String,
19}
20 
21pub struct AuthError(StatusCode, &'static str);
22 
23impl axum::response::IntoResponse for AuthError {
24 fn into_response(self) -> axum::response::Response {
25 (self.0, self.1).into_response()
26 }
27}
28 
29impl<S> FromRequestParts<S> for CurrentUser
30where
31 S: Send + Sync,
32{
33 type Rejection = AuthError;
34 
35 async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self, Self::Rejection> {
36 let header = parts
37 .headers
38 .get(AUTHORIZATION)
39 .and_then(|v| v.to_str().ok())
40 .ok_or(AuthError(StatusCode::UNAUTHORIZED, "missing authorization header"))?;
41 
42 let token = header
43 .strip_prefix("Bearer ")
44 .ok_or(AuthError(StatusCode::UNAUTHORIZED, "invalid scheme"))?;
45 
46 let key = DecodingKey::from_secret(std::env::var("JWT_SECRET").unwrap().as_bytes());
47 let claims = decode::<Claims>(token, &key, &Validation::default())
48 .map_err(|_| AuthError(StatusCode::UNAUTHORIZED, "invalid token"))?
49 .claims;
50 
51 Ok(CurrentUser {
52 id: claims.sub,
53 email: claims.email,
54 })
55 }
56}
01 / 01
STEP 01

Walkthrough

Space play ←→ step click any line
Three takeaways
  1. 1Implementing FromRequestParts lets a type become a first-class handler argument that Axum resolves automatically.
  2. 2Returning a typed Rejection that implements IntoResponse keeps auth failures as clean HTTP responses.
  3. 3Validating credentials inside the extractor centralizes auth so individual handlers stay free of token-parsing logic.

Related explainers

rust 
use serde::Deserialize;
 
#[derive(Debug, Deserialize)]
#[serde(untagged)]

Parsing flexible JSON shapes with serde

deserialization enums json
Intermediate 6 steps
ruby 
require "shellwords"
require "open3"
 
module Backup

Building safe shell commands in Ruby

shell-out subprocess command-injection
Intermediate 7 steps
rust 
use std::cmp::{Ordering, Reverse};
use std::collections::BinaryHeap;
use std::fs::File;
use std::io::{self, BufRead, BufReader, BufWriter, Lines, Write};

K-way merge of sorted logs in Rust

binary-heap k-way-merge streaming-io
Intermediate 8 steps
python 
import time
import uuid
 
from django.utils.deprecation import MiddlewareMixin

Attaching per-request context in Django

middleware request lifecycle multi-tenancy
Intermediate 7 steps
rust 
use axum::{
    extract::{Path, State},
    response::sse::{Event, KeepAlive, Sse},
};

Streaming import progress with SSE in Axum

server-sent-events streams watch-channel
Advanced 7 steps
rust 
use std::f64::consts::PI;
 
#[derive(Debug, Clone, Copy)]
pub struct LatLng {

Building geographic bounding boxes in Rust

geospatial value-types option
Intermediate 7 steps

Share this explainer

Here's the card — post it anywhere.

How a JWT extractor works in Axum — share card
Made with highlit — turn any snippet into a walkthrough like this in about a minute.
Explain your code