Cookie jar (from axum-extra) not passed from one middleware to another?

[nbigaouette]

Summary

I want to setup a scheme where the first time a client connects it gets a cookie with an id. The first client id to connect needs to be considered "admin". Subsequent client connections provides the client id and certain routes are nested under an admin group and must be served only to the admin.

Right now I have something like that:

    let admin_routes = Router::new()
        .nest("/new", new_item)
        .layer(middleware::from_fn_with_state(
            state.clone(),
            admin_middleware,
        ));

    let routes = Router::new()
        .route("/items", list_items)
        .nest("/admin", admin_routes)
        .layer(middleware::from_fn_with_state(
            state.clone(),
            create_client_id_if_absent,
        ))
        .with_state(state);

The middleware signatures are as follow:

async fn create_client_id_if_absent(
    State(mut state): State<AppState>,
    jar: CookieJar,
    request: Request,
    next: Next,
) -> (CookieJar, Response) {
    // Create id if cookie is not present, add new cookie to jar

    (jar, next.run(request).await)
}

async fn admin_middleware(
    State(state): State<AppState>,
    jar: CookieJar,
    request: Request,
    next: Next,
) -> Response {
    // Extract client id from cookie

    if state.is_admin(&client_id) {
        next.run(request).await
    } else {
        (StatusCode::UNAUTHORIZED, "/api routes require admin").into_response()
    }
}

I'm using CookieJar from axum-extra 0.9.3.

So I expect the create_client_id_if_absent() middleware to run first and for all routes. This would create the client it if not present. Then only /admin routes check the validity of the client id.

This kind of work but not completely. Looking at logs for a client connecting to the admin route, I see that the create_client_id_if_absent() middleware is first called, which is good. Then, the admin_middleware() is called, which is also good. But the cookie jar in the admin_middleware() is empty, even though I return the jar in the first middleware.

What am I doing wrong?

Thanks!!

axum version

0.7.5

[nbigaouette]

When I print the cookie jar in the create_client_id_if_absent() middleware, I see that the new cookie added appears in CookieJar::delta_cookies (the CookieJar::original_cookies is empty). But if I print the cookie jar in admin_middleware() the cookie jar is completely empty:

[tp/src/main.rs:231:5] &jar = CookieJar {
    jar: CookieJar {
        original_cookies: {},
        delta_cookies: {},
    },
}

I tried using route_layer() instead of layer() to add the middlewares, but am getting the same behavior. I'm also seeing that CookieJar is from axum-extra, but is itself wrapping CookieJar from the cookie crate (see https://docs.rs/axum-extra/latest/axum_extra/extract/cookie/struct.CookieJar.html and https://docs.rs/axum-extra/latest/src/axum_extra/extract/cookie/mod.rs.html#89-91) but I'm not seeing much options there that could help me...

[jplatte]

Your middleware is adding the modified CookieJar to the response after running the inner service (handler). Unfortunately I think there is no way to make this thing you're trying to do work. It would be possible to pass the CookieJar from the middleware to the handler, but it would be kind of hacky and I would also be a little worried about what happens when the jar is then added to the response twice, in different forms possibly.

I think for your use case, tower-cookies would be a lot less error-prone (though I haven't used it myself, I only assume that it doesn't hit this problem because of how it works).

[nbigaouette]

Thanks! I'm taking a look at tower-cookies. I'm not sure how I would use it to do what I'm trying to do. The example code in there adds a CookieManagerLayer as a layer to a router. It then allows using the Cookies extractor in handlers. But to achieve what I want I would need to check the cookie in all handlers...

If I understand properly, the challenge is that it's not possible for one middleware to add a cookie so that subsequent middlewares would see them. Is that right? In that case, maybe I could remove the create_client_id_if_absent() and replace it with a route that sets the cookie instead. That would force clients to query that route first, but at least the functionality would be there.

What do you think?

Thanks again!