middleware did not take effect

[Yancey2023]

In the following example, the auth middleware did not take effect. It will run create_library directly without identity verification.

web::resource("/library")
        .route(web::get().to(library_handlers::get_libraries))
        .route(web::post().wrap(auth.clone()).to(library_handlers::create_library)),

Your Environment

• Rust Version: 1.89.0
• Actix Web Version: 4.11.0

[silamon]

I don't think you can use wrap on route level, it should be either on app or scope/resource level:

        App::new().service(
            web::scope("/library")
                .route("", web::get().to(library_handlers::get_libraries))
                .service(
                    web::resource("")
                        .wrap(auth.clone())
                        .route(web::post().to(library_handlers::create_library)),
                ),
        )

[Yancey2023]

You are correct. However, my example can compile successfully, which is indeed misleading.

[meshach567]

@Yancey2023 am interested in working on this issue

[robjtede]

Worth mentioning we do have a relevant test:

actix-web/actix-web/src/route.rs

Lines 359 to 395 in f4ee39c

	#[actix_rt::test]
	async fn route_middleware() {
	let srv = init_service(
	App::new()
	.route("/", web::get().to(HttpResponse::Ok).wrap(Logger::default()))
	.service(
	web::resource("/test")
	.route(web::get().to(HttpResponse::Ok))
	.route(
	web::post()
	.to(HttpResponse::Created)
	.wrap(DefaultHeaders::new().add(("x-test", "x-posted"))),
	)
	.route(
	web::delete()
	.to(HttpResponse::Accepted)
	// logger changes body type, proving Compat is not needed
	.wrap(Logger::default()),
	),
	),
	)
	.await;
	let req = TestRequest::get().uri("/test").to_request();
	let res = call_service(&srv, req).await;
	assert_eq!(res.status(), StatusCode::OK);
	assert!(!res.headers().contains_key("x-test"));
	let req = TestRequest::post().uri("/test").to_request();
	let res = call_service(&srv, req).await;
	assert_eq!(res.status(), StatusCode::CREATED);
	assert_eq!(res.headers().get("x-test").unwrap(), "x-posted");
	let req = TestRequest::delete().uri("/test").to_request();
	let res = call_service(&srv, req).await;
	assert_eq!(res.status(), StatusCode::ACCEPTED);
	}

The only difference to OP's code sample is the ordering of .wrap and .to.