Module middleware 

Middleware: tower layers over the whole application, plus batteries.

App::layer accepts any tower::Layer over BoxService, the application as a Service<http::Request<Body>>. from_fn builds one from an async function.

Ordering

The first layer registered is the outermost: it sees the request first and the response last, exactly like reading ServiceBuilder top to bottom. app.request_id().request_logging().cors(..) runs request-id, then logging, then CORS, then the routes. Registration order relative to with_state, provide, … does not matter: middleware always wraps those. Middleware of the root app also wraps 404s and the documentation endpoints; middleware of a mounted child wraps only that child’s routes.

Errors

Rejections produced by built-in middleware are RFC 7807 application/problem+json documents (ApiError).

Built-ins

Cors, Compression, CsrfOrigin, TrustedHosts, HttpsRedirect, RequestIdLayer (+ RequestId extractor), RequestLogging, Timeout, ConcurrencyLimit, BodyLimit and RateLimit, each with a same-named convenience method on App.

Structs

BodyLimit

Rejects request bodies larger than a limit with a 413 problem.

Compression

Response compression (gzip and brotli, negotiated via Accept-Encoding).

ConcurrencyLimit

Bounds execution and waiting, returning 503 with Retry-After on overload.

ConcurrencyLimitError

Invalid concurrency or queue-deadline configuration.

ConcurrencyStats

Admission counters shared by all clones of a limit.

Cors

Cross-origin resource sharing.

CsrfOrigin

Rejects cross-site state-changing requests by checking their origin.

CsrfOriginError

A configured origin that is not scheme://host[:port].

FromFnLayer

Layer returned by from_fn.

HttpsRedirect

Redirect plain HTTP to HTTPS with an explicit proxy and authority policy.

Next

The rest of the middleware chain, handed to from_fn closures.

ProxyContext

Validated client and transport context from one proxy policy.

ProxyError

Invalid or ambiguous headers supplied by a trusted proxy peer.

RateLimit

Token-bucket rate limiter keyed by validated client IP.

RateLimitError

Invalid rate-limiter configuration.

RequestId

The id of the current request, set by the RequestIdLayer middleware.

RequestIdLayer

Assigns every request an id: an incoming x-request-id is propagated when it is 1..=128 visible ASCII characters, otherwise a UUID v4 is generated. The id is exposed as RequestId, forwarded to the handler as a request header and echoed on the response.

RequestLogging

Emits an http.request tracing span per request with request_id, method, route (matched path template via axum MatchedPath, or "<unmatched>"), status and latency_ms.

Timeout

Fails requests that take longer than a deadline (default status 504).

TrustedHosts

Rejects requests whose Host is not on an allow-list (400 problem).

TrustedProxies

Proxy peers permitted to supply forwarded client and scheme headers.

Functions

from_fn

Build a middleware layer from an async function (Request, Next) -> Response.

Type Aliases

BoxService

The service type middleware layers wrap: the rest of the application.