Zer
Status and limits of the session-management prototype.
rspc-zer is an unfinished session-management experiment. It reads a named cookie, decodes a signed JWT into a session type, and can create a response cookie for a new session.
Do not use Zer as production authentication. The prototype disables required JWT claims, can panic when decoding invalid cookies or tokens, and does not set a complete secure cookie policy.
What exists
The source exposes Zer::from_request, session, set_session, and ZerResponse::set_cookie_header. The HTTP integration still has to read the request cookie and apply the response header.
This is not a complete authentication system. It does not provide a finished OAuth flow, email sign-in, refresh-token rotation, or session revocation. Zer::noop is also unimplemented.
Application authentication
Use an authentication library or service that fits your application. Verify the session in the transport or middleware, then put verified identity data in request context. Check authorization again for the resource each procedure accesses.
See context-switching middleware for passing an authenticated context to a resolver.
Last updated on