Axum, Actix and Tower in anger: routing, middleware, APIs, and WebAssembly when the code has to run in a browser.
Expose Prometheus metrics from a Rust service: counters, gauges and histograms with the metrics crate, an Axum /metrics endpoint, labels to keep small and useful metrics to start with.
Abuse prevention goes beyond a request counter: separate limits per route and identity, login throttling, lockouts without enabling denial of service, enumeration defense and cost-based limits.
Run untrusted plugins or user code from Rust inside WebAssembly with wasmtime: fuel for CPU limits, memory caps, no ambient file or network access, and host functions you choose.
Binding a port that is taken fails with Address already in use, os error 98. Find the process holding it, handle TIME_WAIT and restarts, and fail with a useful message.
Implement the OAuth 2 authorization code flow with PKCE in Rust using the oauth2 crate: build the client, redirect, verify state, exchange the code and store tokens safely.
A guide to compiling Rust to WebAssembly: the targets, wasm-bindgen, calling between Rust and JavaScript, size, testing and when WebAssembly is worth it.
Choose log levels by who reads them and when: what belongs at error, warn, info, debug and trace in a Rust service, what never to log, and how much is too much.
A user-supplied filename like ../../etc/passwd escapes your upload directory. Reject components, canonicalize and verify the prefix, and see why Path::join with an absolute path is a trap.
Axum and Actix Web are both fast and mature. The real differences are the runtime model, middleware ecosystem and ergonomics, and this post lays out how to decide.
Handle SIGTERM and Ctrl C so Axum finishes in-flight requests before exiting. Includes the signal future, the drain timeout and the Kubernetes and systemd details.
The mistakes that make JWT checks worthless: accepting the none algorithm, trusting the header's alg, skipping exp and aud, and mixing key types. Validate correctly with the jsonwebtoken crate.
Test an Axum router without opening a port: build a Request, call oneshot, read the body and assert on status and JSON. Includes the setup for shared state.
We send one email when a new post is published. No spam.