axum-impl-authorization

Overview

Authorization answers "is this known user allowed to do this". It is a separate concern from authentication, which answers "who are you". Authentication is handled by axum-impl-auth-jwt and produces a verified Claims value. Authorization always runs AFTER authentication and reads that Claims value.

Axum has no built-in authorization. It provides the building blocks: FromRequestParts extractors, from_fn and from_fn_with_state middleware, and the route_layer application method. There are two mechanisms, and they are NOT interchangeable: