Tag
21 posts
Treat every upload as hostile: limit the size, sniff the real content type, ignore the client filename, store outside the web root under generated names, scan where needed and serve with safe headers.
Verify webhook signatures in Rust: read the raw body, compute HMAC-SHA256, compare in constant time, check the timestamp against replay and respond fast with a queue.
Make POST requests safe to retry: clients send an Idempotency-Key, the server stores the first result keyed on it and replays it. An Axum and SQLx implementation with edge cases.
Axum and Actix Web are both fast and mature. The real differences are the runtime model, middleware ecosystem and ergonomics, and this post lays out how to decide.
Handle SIGTERM and Ctrl C so Axum finishes in-flight requests before exiting. Includes the signal future, the drain timeout and the Kubernetes and systemd details.
Test an Axum router without opening a port: build a Request, call oneshot, read the body and assert on status and JSON. Includes the setup for shared state.
Accept and return JSON in Axum with the Json extractor and Serde: validate input, set status codes, handle bad bodies and avoid common content type mistakes.
Add structured logs and a request id to every Axum request with tower-http TraceLayer, SetRequestIdLayer and tracing spans that carry the id into your code.
Make every Axum handler return Result with one AppError enum that implements IntoResponse, so the question mark works and clients get consistent JSON errors.
Test an Axum API against a real Postgres started by Testcontainers: one container per test binary, one migrated database per test, the leaks and version traps that bite, and measured timings for each isolation strategy.
Wire Axum 0.8 and SQLx 0.9 into a typed database layer: a pool in state, a db module of compile-time checked queries, one error type, a transaction, offline builds and tests on throwaway databases.
Server sent events push updates from Axum to the browser over plain HTTP. See Sse, Event, KeepAlive, streams from channels, reconnect with Last-Event-ID and proxy gotchas.