Add persistent session support and logout functionality. This project is now by definition feature-complete.

Author: fox34

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "nginx-auth-server"
-version = "0.3.0"
+version = "1.0.0"
 authors = ["Steffen Manzer"]
 edition = '2024'
 
@@ -14,12 +14,13 @@ strip = true        # Strip symbols from binary
 [dependencies]
 axum = "0.8"
 axum-extra = { version = "0.10", features = ["cookie"] }
-cookie = "0.18"
+chrono = { version = "0.4", features = ["serde"] }
 clap = { version = "4.5", features = ["derive"] }
-tokio = { version = "1", features = ["full"] }
-serde = { version = "1", features = ["derive"] }
-#pam = "0.8" # uses `users`, see RUSTSEC-2023-0059 and commit #0f6862e
-pam = { git = "https://github.com/1wilkens/pam.git", rev = "daf26ae3512d8e5a7478ccff1e4232ef5ebf9b03" }
+cookie = "0.18"
+once_cell = "1.21"
 otpauth = "0.5"
+pam = { git = "https://github.com/1wilkens/pam.git", rev = "daf26ae3512d8e5a7478ccff1e4232ef5ebf9b03" } # latest release 0.8 still uses deprecated `users` crate, this rev switched to `uzers`
+serde = { version = "1", features = ["derive"] }
+serde_json = "1.0"
+tokio = { version = "1", features = ["full"] }
 uuid = { version = "1", features = ["v4"] }
-once_cell = "1.21"

Cargo.toml

@@ -1,6 +1,6 @@
 # nginx auth request server
 
-This is a **small and lightweight** http server, to be used by nginx to authenticate users against linux system users via PAM and an auxiliary totp file with `ngx_http_auth_request_module`.
+This is a **small and lightweight** http authentication server, to be used by nginx with `ngx_http_auth_request_module` to authenticate your website visitors against linux system users via PAM, providing additional security with two-factor-authentication.
 
 ## Request flow
 
@@ -12,17 +12,11 @@ This is a **small and lightweight** http server, to be used by nginx to authenti
 
 Everything is *intentionally* kept as simple and minimal as viable.
 This project is more a simple to understand tech-demo and minimal working example rather than a full-featured user and session manager.
+If you really do want to add features, please open a *discussion* first before you create a PR.
+Otherwise, feel free to create a fork for your personal requirements.
 
-This code is provided as-is without support.
-Since this is my first rust project, the code quality may vary and be suboptimal to some extent.
-Feel free to open a PR to improve potential issues. :-)
-
-Use at your own risk, error handling is very, very basic.
-
-### Planned features
-
-- Session expiration
-- Logout functionality
+Since this is my very first rust project, code may be suboptimal or even insecure to some extent - use at your own risk.
+PRs to improve code quality and security are highly appreciated.
 
 ## Recommended usage