---
title: "Guardian"
tagline: "Auth server"
language: "Rust"
license: "MIT"
since: "2021"
canonical: "https://xraph.com/work/guardian-rust"
---

# Guardian

An auth server in Rust covering OAuth, sessions, email templates and the usual set. A learning project that later shaped how Authsome splits authentication methods into plugins instead of configuration flags.

## Install

```bash
cargo add guardian
```

## What it is

An authentication server in Rust from 2021: OAuth, session handling, all the standard auth types, email templates and rendered pages.

It was a learning project, and the thing it taught me outlasted the code. Every authentication method I added, whether password, OAuth or magic link, wanted a different shape of configuration, a different storage requirement and a different set of routes, and expressing that as configuration flags on one server produced a config surface nobody could reason about.

Authsome's method-as-plugin structure is that lesson applied five years later. An application that never needs SAML does not carry SAML code, SAML configuration or SAML attack surface.

---

*Unpublished draft. Not peer reviewed and not submitted to a venue.*


## Anatomy

- **Auth server**: Sessions and tokens for the Rust stack.

## Constraints and trade-offs

- (known gap) The identity model here is the one Authsome later fixed.