Rust and OICD and gateway/proxy

1

We have a collection of services over the web that have grown over the last few years with total disregard for security. That was OK they were all proofs of concept nowhere near productionizing. Of course now I have been tasked with catering for user signup, authentication login, logouts, roles etc, etc. Basically the idea is to have a front end gateway/proxy that handles all that stuff and forwards authenticated connections to the backend services.

Being a long time application and embedded system developer I know nothing about any of this. In general I'm allergic to web development, I have had to deal with it in the past and it always seemed to be a swamp full of alligators and snakes with all that node.js and js and frameworks etc. And PHP before that.

Latching on to the idea that OIDC is the thing now a days I find the problem is that all the information, SDKs and examples of using OIDC I found are in JS and such. Eweee. So last week I set about building such a proxy/gateway in Rust and I now have something that works, at least with the services of Auth0 and Clerk. My AI friend helped but we won't talk about that neither will I burden you with the code (Which actually looks quite good by the way). It's a mashup of Axum, reqwest, serde etc as one might expect.

On further investigation today I discover there are crates that look like they do what we want already. For example axum-oidc-client for all that sign up, login, logout stuff. And Axum-oidc-layer for backend bearer token checking.

Brilliant, how come I missed these in my original investigations. Obviously it would be better to not roll our own when it comes to security and use something robust and well used/tested.

Anyway. My questions:

Given that I'm now going to rebuild our gateway/proxy what other options in Rust world should I be looking at? Different web frameworks, different OIDC crates etc.

Does anyone here have experience of such things. What should I pay special attention to?

Any links to good resources to learn more about such things?

Heck, is this even a good idea or are there better ways?

Any hints, tips and suggestions welcome.

Be patient I'm not up to speed with the language people use to talk about all this web and security stuff.

2

I do find the official specification a nice read, as it is quite specific and implementation-oriented. Chapters 1 to 5 at least, never had to read past them. Coupled with summary articles (the Auth0 docs come up often in my web searches and have been helpful to me in the past) about JWTs, and the JOSE types like JWKS, etc., I think you can get an implementation off the ground quickly and securely. You should be aware though that the JOSE standards pack a bunch of vulnerabilities (mostly revolving around the alg field in the JWT) that are exploitable if your validation is not properly set up.

3

Well, that was fun. Spent the afternoon with my AI friend trying to replace our hand rolled OICD stuff with the axum-oidc-client crate. Turned out not to be possible.

Then tried going down a level and using openidconnect and oauth2. That at least compiled and ran but could not connect to Auth0.

So after going around the houses I'm back to the hand rolled OICD proxy/gateway.

This AI thing is a disaster sometimes.