title: How can I make protected routes in actix-web
body: <p>I need to verify if the user has permission for some routes.
  I have made 3 &quot;scopes&quot; (guest, auth-user, admin) and now I don't know how to check if the user has access to these routes.</p>
  <p>I'm trying to implement auth-middleware and this middleware should check if the user has the correct cookie or token. (I'm able to print out a cookie from request header), but I have no idea how to import, use actix_identity, and have access to id parameter inside this middleware.</p>
  <p>I believe that my problem isn't only regarding Actix-identity, but I'm not able to pass parameters inside middleware.</p>
  <pre class="lang-rust prettyprint-override"><code>    #[actix_rt::main]
      async fn main() -&gt; std::io::Result&lt;()&gt; {
  
          let cookie_key = conf.server.key;
      
          // Register http routes
          let mut server = HttpServer::new(move || {
              App::new()
                  // Enable logger
                  .wrap(Logger::default())
                  .wrap(IdentityService::new(
                      CookieIdentityPolicy::new(cookie_key.as_bytes())
                          .name(&quot;auth-cookie&quot;)
                          .path(&quot;/&quot;)
                          .secure(false),
                  ))
                  //limit the maximum amount of data that server will accept
                  .data(web::JsonConfig::default().limit(4096))
                  //normal routes
                  .service(web::resource(&quot;/&quot;).route(web::get().to(status)))
                  // .configure(routes)
                  .service(
                      web::scope(&quot;/api&quot;)
                          // guest endpoints
                          .service(web::resource(&quot;/user_login&quot;).route(web::post().to(login)))
                          .service(web::resource(&quot;/user_logout&quot;).route(web::post().to(logout)))
                          // admin endpoints
                          .service(
                              web::scope(&quot;/admin&quot;)
                                  // .wrap(AdminAuthMiddleware)
                                  .service(
                                      web::resource(&quot;/create_admin&quot;).route(web::post().to(create_admin)),
                                  )
                                  .service(
                                      web::resource(&quot;/delete_admin/{username}/{_:/?}&quot;)
                                          .route(web::delete().to(delete_admin)),
                                  ),
                          )
                          //user auth routes
                          .service(
                              web::scope(&quot;/auth&quot;)
                                  // .wrap(UserAuthMiddleware)
                                  .service(web::resource(&quot;/get_user&quot;).route(web::get().to(get_user))),
                          ),
                  )
          });
      
          // Enables us to hot reload the server
          let mut listenfd = ListenFd::from_env();
          server = if let Some(l) = listenfd.take_tcp_listener(0).unwrap() {
              server.listen(l)?
          } else {
              server.bind(ip)?
          };
      
          server.run().await
  </code></pre>
  <p>resources that I have tried:</p>
  <ol>
  <li><p>Creating authentication middleware for Actix API
  <a href="https://www.jamesbaum.co.uk/blether/creating-authentication-middleware-actix-rust-react/" rel="noreferrer">https://www.jamesbaum.co.uk/blether/creating-authentication-middleware-actix-rust-react/</a></p>
  </li>
  <li><p>Actix-web token validation in middleware <a href="https://users.rust-lang.org/t/actix-web-token-validation-in-middleware/38205" rel="noreferrer">https://users.rust-lang.org/t/actix-web-token-validation-in-middleware/38205</a></p>
  </li>
  <li><p>Actix middleware examples <a href="https://github.com/actix/examples/tree/master/middleware" rel="noreferrer">https://github.com/actix/examples/tree/master/middleware</a></p>
  </li>
  </ol>
  <p>Maybe I think completely wrong and auth-middleware isn't the best solution for my problem.
  I hope that you can help me create &quot;protected routes&quot;</p>