Sample
axum 0.8.9: Protect axum routes with stateful middleware using from_fn_with_state, isolate route_layer from 404 fallbacks, and manage bottom-to-top layer execution order
Verified sample for cargo axum 0.8.9: Protect axum routes with stateful middleware using from_fn_with_state, isolate route_layer from 404 fallbacks, and…
sha256:0add9e86ea54fb151285ed7fff0ac6a073835d84159f6bfc43b6e447f030a7be
This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured.
How many distinct signing keys filed a passing contract receipt. One is the author alone; more than one means somebody else built it too. A key is self-generated with nothing registered behind it, so it counts keys, not people.
MIT-0
Execution evidence
The declared environment and the signed runs are kept apart, so you can see exactly what this sample ran and where.
- Evidence basis
- Signed contract pass
- Verification receipts
- 2
- Signing keys that built it
- 2
Declared environment
rust linux x64 rust rust cargo
Verification-run environments
| Environment | Contract | Stages | Run |
|---|---|---|---|
| rust 1 · linux alpine/x64 · docker ed25519:d91480838ac982c9 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · cargo@1 |
2026-08-16 |
| rust 1 · linux alpine/x64 · docker ed25519:2175b912ea1c23b1 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · cargo@1 |
2026-08-18 |
Case
HOW- Goal
- Protect axum routes with stateful middleware using from_fn_with_state, isolate route_layer from 404 fallbacks, and manage bottom-to-top layer execution order
- Symbols
-
- axum::middleware::from_fn
- axum::middleware::from_fn_with_state
- axum::middleware::Next
- axum::Router::route_layer
- axum::Router::layer
- axum::extract::Extension
- axum::extract::State
- axum::extract::Request
- Environment
- rust
- Created
- 2026-08-16T08:11:01Z
Contract
- assert route_layer protects routes registered before it, returning 200 with typed Extension and injected headers when authorization token is valid
- assert route_layer rejects unauthorized requests with 401 and custom error headers without invoking the route handler
- assert route_layer leaves public routes registered after it unprotected, returning 200 without executing the auth middleware or incrementing state call counter
- assert an unmatched 404 route on a route_layer router returns 404 Not Found without invoking auth middleware
- assert Router::layer wraps the entire router including 404 fallbacks, returning 401 Unauthorized for unmatched paths when authorization is absent
- assert an unpopulated Extension extractor fails dynamically at runtime with 500 Internal Server Error when the route is not wrapped by the populating middleware
- assert chained layers execute in reverse registration order (bottom-to-top): outer layer runs before inner layer on request, and inner layer runs before outer layer on response
- assert sub-router route_layer middleware is isolated to the nested prefix and does not run on parent router routes
Files
- Cargo.lock
- Cargo.toml
- NOTES.md
- csx.json
- src/lib.rs
- tests/middleware_tests.rs