Should we add a security module?

[takkuumi]

See this blog, https://fasterthanli.me/articles/i-won-free-load-testing?s=09 .

I can help ,if we have a guide.

[davidpdrsn]

What would go in such a module?

[takkuumi]

I think Spring security is a good guide. Although some of its entry are around Servlet.
An other idea about XSS, we can provide an XSS filter. XSS Wiki.

Other ideas, I still need time to complete them. Such as IP list and so on.

[davidpdrsn]

You really need to be more clear. I cannot read your mind. Feels like a lot context is missing.

All the things mentioned in the linked article are already in tower or could be.

Other ideas, I still need time to complete them. Such as IP list and so on.

Are you saying that you're already writing a guide and will submit that as a PR? That's what it sounds like to me. I don't think that is the right approach. You're free to publish your own guide but we need to coordinate if you want things merged.

I don't see how axum could have something like XSS protection built-in. How to sanitize user input depends entirely on which HTML crate the user is using. Axum has no opinion about that.

[takkuumi]

My idea is to provide some tools to deal with security issues that axum does not yet provide solutions for, .

For example: IP list filter (applicable to applications that do not use NGINX proxy), which is convenient for users to deal with some attacks concentrated in a certain area.

Another example: API services often need to do some processing on the content sent by the client. We can (just an idea) provide an XSS filtering tool (Maybe Layer or Extract), just like BoxError in axum, when users need this and then he finds there is already a tool in axum that might help him.

Another example: axum(tower_http) provides the ServeDir function, It can implement static resource sites. We should provide CSP management capabilities, which are very useful in some cases.

There are many details that we can perfect bit by bit.

All these details are what I call security modules.

Regarding that blog, I wanted to show that, in addition to functionality, security concerns are also a frequent challenge for users.

I say I can help because I'm a web developer. Now I don't think I can extract the security module to handle various security issues. But I can solve it with the help of wizard(contribute PR).

[davidpdrsn]

Alright. That makes things more clear. Thanks for clarifying.

To me it sounds like all those things can be built in external crates and thats probably the best for you to start. Then once things have matured we can consider if can/should be moved into axum itself.