axum-impl-auth-session
Installation
SKILL.md
axum-impl-auth-session
Overview
Session-based authentication stores NO user data in the cookie. The cookie carries only an opaque, unguessable session ID; all real state (user id, roles, CSRF token) lives server-side in a session store. This is the structural opposite of JWT, where the token IS the state and the server holds nothing.
Axum ships no session machinery. This skill covers the four stateful and delegated auth approaches and the crates that provide them:
| Approach | Crate | Use for |
|---|---|---|
| Raw sessions | tower-sessions |
session layer, no opinion on login |
| Full login system | axum-login (on tower-sessions) |
typed user, login/logout, route guards |
| HTTP Basic | axum-extra TypedHeader |
machine-to-machine over TLS |
| OAuth2 | oauth2 |
delegated identity (Google, GitHub, SSO) |