Rocket is a delight. Been using it for a year now and the docs and dev experience and stability are all exceptional.
Request Guard Transparency[1] is something I’ve only seen in Rocket:
> When a request guard type can only be created through its FromRequest implementation, and the type is not Copy, the existence of a request guard value provides a type-level proof that the current request has been validated against an arbitrary policy. This provides powerful means of protecting your application against access-control violations by requiring data accessing methods to witness a proof of authorization via a request guard. We call the notion of using a request guard as a witness guard transparency.
Basically your endpoints can require access to a protected service via a parameter and you’re guaranteed that your code will only execute for valid&authorized requests. For example, imagine a UserService and a TeamAdminService, each with their own methods appropriate for their user type. Request guards are used to validate the request headers and database entries are correct before constructing these services. And since you can only construct them from a request, simply having a service listed as a parameter in your endpoint guarantees that the proper access control has be enforced before your code runs.
We’ve structured our app so that every sensitive operation goes through these services, thereby sidestepping entire classes of security concerns and missteps. I sleep better as a result and our security reviews are much more enjoyable.
I’d love to see this discussed more and adopted by more frameworks.
I agree providing the Secret Key to other devices can be a pain. In fact it's our #1 onboarding challenge. On Apple devices specifically it's much easier as we can store it in iCloud Keychain, but we'd like to make it simpler everywhere.
Curious if you've had a chance to try the Setup Code? It's not as slick as iCloud since we don't own the OS, but it enables you to scan the code and get all the account details on your new device. That way all you need to do is type your password.
On that note we recently had a hackathon around this to make things even simpler and we had some success there. I'm hoping we can make this real and share it in an update later this year.