Rust Web Security Delivery

Establish attacker, asset, and trust boundaries first; then select crates and middleware. Rust's memory safety does not automatically provide authentication, authorization, protocol enforcement, or business logic security; default to deny all, and use negative testing to prove control is effective.

Confirming the Security Contract

Before modifications:

• Identify service exposure surfaces, callers, browser/API/service-to-service traffic, and management endpoints;
• Determine where TLS terminates, which proxies are trusted, and how client IP/host/scheme originates;
• Define identity providers, authentication protocols, token/session types/lifecycles;
• Specify roles, scopes, object ownership, tenant boundaries, and sensitive business operations;
• Manage key storage/renewal for cookies, passwords, API keys, webhooks;
• Configure CORS, CSRF, redirects, uploads, outbound URLs, and webhook scenarios;
• Define rate limiting budgets per body size/parallelism/timeout requirements and abuse resistance policies;
• Establish audit event definitions, privacy standards, compliance needs, and incident response procedures;
• Lock versions of axum, tower, rustls, cookie crates along with Rust MSRV.

When security requirements are incomplete, explicitly state assumptions and uncovered risks. Do not bypass validation by weakening tests to achieve pass/fail outcomes.