Skip to content

Conversation

@ThanhNguyxn
Copy link

@ThanhNguyxn ThanhNguyxn commented Dec 3, 2025

🦀 Add Rust Actix Web Development Rules

Description

This PR adds comprehensive cursor rules for Rust Actix Web framework development - the #1 ranked web framework in TechEmpower benchmarks.

What's Included

.cursorrules (1,300+ lines):

  • 🏗️ Clean Architecture - Handlers, Services, Repositories pattern
  • 🗄️ SQLx Integration - Compile-time verified database queries with PostgreSQL
  • ⚠️ Error Handling - Custom AppError implementing ResponseError trait
  • 🔐 Authentication - JWT auth with custom extractors
  • 🛡️ Middleware - Auth, logging, rate limiting patterns
  • 🧪 Testing - Integration test patterns with test helpers
  • Performance - Connection pooling, compression, optimization tips

Key Features Covered

  • Actix Web 4.x patterns
  • Tokio async runtime
  • Serde serialization
  • Validator for request validation
  • Argon2 password hashing
  • Structured logging with tracing

Folder Structure

rules/rust-actix-web-cursorrules-prompt-file/
├── .cursorrules # Main rules file
└── README.md # Documentation

Why Rust Actix Web?

  • 🚀 Consistently NestJs rules quite similar to mines 🤔 #1 in performance benchmarks
  • 🔒 Memory safety without garbage collection
  • 🌐 Production-ready (used by Microsoft, Amazon, Discord)
  • 📈 21k+ GitHub stars, active community

- hono-typescript-cloudflare: Edge-first APIs with Hono v4 and Cloudflare Workers
- drizzle-orm-typescript: Type-safe database layer with Drizzle ORM
- remix-react-typescript: Full-stack web apps with Remix v2 and React
- bun-typescript-runtime: Fast all-in-one JavaScript runtime with Bun
- Fix variable redeclaration in Bun file I/O example (file -> metaFile)
- Fix async test assertion to use rejects.toThrow()
- Add missing useRouteError, isRouteErrorResponse imports in Remix
- Add SESSION_SECRET validation before use
- Add language identifiers to README code blocks
- Comprehensive Actix Web 4.x patterns and best practices
- Clean Architecture with handlers, services, repositories
- SQLx for compile-time verified database queries
- Custom error handling with ResponseError trait
- JWT authentication and custom extractors
- Middleware patterns (auth, logging, rate limiting)
- Integration testing patterns
- Performance optimization guidelines
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Dec 3, 2025

Walkthrough

Adds five new comprehensive .cursorrules prompt files with accompanying README documentation for Bun TypeScript, Drizzle ORM TypeScript, Hono Cloudflare Workers, Remix React TypeScript, and Rust Actix Web. These files provide guidance patterns, code examples, and best practices for configuring Cursor AI to act as experts in each technology domain.

Changes

Cohort / File(s) Summary
Bun TypeScript Runtime
rules/bun-typescript-runtime-cursorrules-prompt-file/.cursorrules, rules/bun-typescript-runtime-cursorrules-prompt-file/README.md
Adds comprehensive Bun expert prompt covering HTTP servers, file operations, SQLite, testing, packaging, and WebSocket patterns, plus usage documentation.
Drizzle ORM TypeScript
rules/drizzle-orm-typescript-cursorrules-prompt-file/.cursorrules, rules/drizzle-orm-typescript-cursorrules-prompt-file/README.md
Introduces Drizzle ORM TypeScript guidance with schema examples, database connections, query patterns, migrations, and repository patterns.
Hono TypeScript Cloudflare
rules/hono-typescript-cloudflare-cursorrules-prompt-file/.cursorrules, rules/hono-typescript-cloudflare-cursorrules-prompt-file/README.md
Adds Hono edge computing expert prompt for Cloudflare Workers with bindings, routing, middleware, and testing guidance.
Remix React TypeScript
rules/remix-react-typescript-cursorrules-prompt-file/.cursorrules, rules/remix-react-typescript-cursorrules-prompt-file/README.md
Establishes Remix v2 full-stack patterns including loaders, actions, error boundaries, form validation, and authentication.
Rust Actix Web
rules/rust-actix-web-cursorrules-prompt-file/.cursorrules, rules/rust-actix-web-cursorrules-prompt-file/README.md
Introduces Actix Web 4.x development guidelines with configuration, routing, error handling, middleware, and security patterns.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

  • All changes are documentation/prompt files with no executable logic or functional code modifications
  • Homogeneous pattern repeated across five technology stacks (reduces cognitive load per file)
  • Content verification is primarily structural and stylistic rather than logic-focused
  • Each .cursorrules + README pair follows consistent documentation patterns

Possibly related issues

Suggested reviewers

  • PatrickJS

Poem

🐰 Five new scrolls of wisdom bright,
TypeScript, Rust, and Web in flight,
Hono hops and Remix spins,
Bun and Drizzle—let the magic begin! ✨

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Title check ⚠️ Warning The PR title 'Add rust actix rules' is too vague and doesn't capture the full scope. The changeset adds multiple comprehensive cursor rules (Bun TypeScript, Drizzle ORM, Hono Cloudflare, Remix React, AND Rust Actix Web), but the title only mentions Rust Actix, partially describing the changes. Revise the title to reflect all major additions, e.g., 'Add cursor rules for Rust Actix Web, Bun TypeScript, Drizzle ORM, Hono, and Remix' or clarify scope if intentionally focused on Actix only.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

🧹 Nitpick comments (3)
rules/bun-typescript-runtime-cursorrules-prompt-file/.cursorrules (2)

126-132: SQLite prepared statement typing could be clarified.

The type parameter order for db.prepare appears to be <ResultType, ParamsType>. Consider adding a brief comment to clarify this for users unfamiliar with Bun's SQLite API, as it differs from some other database libraries.

 // Prepared statements (recommended)
+// Type parameters: <ResultType, ParamsTuple>
 const insertUser = db.prepare<{ email: string; name: string }, [string, string]>(
   'INSERT INTO users (email, name) VALUES (?, ?) RETURNING *'
 )

304-316: Consider using TOML code block for bunfig.toml comment.

The bunfig.toml configuration is shown as a comment inside a TypeScript code block, which could be confusing. Consider separating it into its own TOML code block for clarity.

 ### Type Safety
-```typescript
-// bunfig.toml for strict mode
-// [install]
-// auto = "force"
-
-// tsconfig.json
+
+```toml
+# bunfig.toml for strict mode
+[install]
+auto = "force"
+```
+
+```json
+// tsconfig.json
 {
   "compilerOptions": {
     "strict": true,
     "types": ["bun-types"]
   }
 }

</blockquote></details>
<details>
<summary>rules/drizzle-orm-typescript-cursorrules-prompt-file/.cursorrules (1)</summary><blockquote>

`87-114`: **Clarify that connection examples are alternatives, not combined.**

The two database connection examples (PostgreSQL and Turso/LibSQL) both declare `export const db`, which could confuse users into thinking they should be combined. Consider adding a comment to clarify these are separate alternatives.



```diff
 // PostgreSQL with node-postgres
 import { drizzle } from 'drizzle-orm/node-postgres'
 import { Pool } from 'pg'
 import * as schema from './schema'

 const pool = new Pool({
   connectionString: process.env.DATABASE_URL,
   max: 20,
   idleTimeoutMillis: 30000,
   connectionTimeoutMillis: 2000,
 })

 export const db = drizzle(pool, { schema, logger: true })

-// Turso/LibSQL
+// Alternative: Turso/LibSQL (use one or the other, not both)
 import { drizzle } from 'drizzle-orm/libsql'
📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between fc2ce04 and b9ccc75.

📒 Files selected for processing (10)
  • rules/bun-typescript-runtime-cursorrules-prompt-file/.cursorrules (1 hunks)
  • rules/bun-typescript-runtime-cursorrules-prompt-file/README.md (1 hunks)
  • rules/drizzle-orm-typescript-cursorrules-prompt-file/.cursorrules (1 hunks)
  • rules/drizzle-orm-typescript-cursorrules-prompt-file/README.md (1 hunks)
  • rules/hono-typescript-cloudflare-cursorrules-prompt-file/.cursorrules (1 hunks)
  • rules/hono-typescript-cloudflare-cursorrules-prompt-file/README.md (1 hunks)
  • rules/remix-react-typescript-cursorrules-prompt-file/.cursorrules (1 hunks)
  • rules/remix-react-typescript-cursorrules-prompt-file/README.md (1 hunks)
  • rules/rust-actix-web-cursorrules-prompt-file/.cursorrules (1 hunks)
  • rules/rust-actix-web-cursorrules-prompt-file/README.md (1 hunks)
🧰 Additional context used
📓 Path-based instructions (3)
**/*.md

📄 CodeRabbit inference engine (.cursorrules)

Always use Markdown for documentation and README files

Files:

  • rules/bun-typescript-runtime-cursorrules-prompt-file/README.md
  • rules/remix-react-typescript-cursorrules-prompt-file/README.md
  • rules/hono-typescript-cloudflare-cursorrules-prompt-file/README.md
  • rules/drizzle-orm-typescript-cursorrules-prompt-file/README.md
  • rules/rust-actix-web-cursorrules-prompt-file/README.md
rules/*/README.md

📄 CodeRabbit inference engine (.cursorrules)

rules/*/README.md: Refer to the README in each folder for guidance on naming conventions and descriptions
Each .cursorrules file may have an accompanying README.md file in its folder; use this README to provide credit to the original author and a brief description of the .cursorrules file's purpose

Files:

  • rules/bun-typescript-runtime-cursorrules-prompt-file/README.md
  • rules/remix-react-typescript-cursorrules-prompt-file/README.md
  • rules/hono-typescript-cloudflare-cursorrules-prompt-file/README.md
  • rules/drizzle-orm-typescript-cursorrules-prompt-file/README.md
  • rules/rust-actix-web-cursorrules-prompt-file/README.md
**/*.{md,cursorrules}

📄 CodeRabbit inference engine (.cursorrules)

**/*.{md,cursorrules}: Use clear and concise language in all documentation and .cursorrules files
When adding examples or explanations, focus on practical use cases for Cursor AI users

Files:

  • rules/bun-typescript-runtime-cursorrules-prompt-file/README.md
  • rules/remix-react-typescript-cursorrules-prompt-file/README.md
  • rules/hono-typescript-cloudflare-cursorrules-prompt-file/README.md
  • rules/drizzle-orm-typescript-cursorrules-prompt-file/README.md
  • rules/rust-actix-web-cursorrules-prompt-file/README.md
🪛 LanguageTool
rules/rust-actix-web-cursorrules-prompt-file/README.md

[uncategorized] ~12-~12: If this is a compound adjective that modifies the following noun, use a hyphen.
Context: ...eware** patterns for auth, logging, and rate limiting - Testing integration patterns with...

(EN_COMPOUND_ADJECTIVE_INTERNAL)


[uncategorized] ~32-~32: If this is a compound adjective that modifies the following noun, use a hyphen.
Context: ...authentication with custom extractors - Rate limiting middleware ## Usage 1. Copy the `.cur...

(EN_COMPOUND_ADJECTIVE_INTERNAL)

🔇 Additional comments (10)
rules/remix-react-typescript-cursorrules-prompt-file/README.md (1)

1-61: Well-structured README with clear documentation.

The README follows good documentation practices with a clear overview, tech stack listing, feature coverage checklist, usage instructions, and example project structure. The links to official Remix resources are appropriate.

rules/rust-actix-web-cursorrules-prompt-file/README.md (1)

1-75: Documentation structure is comprehensive and follows the established pattern.

The README provides clear guidance on what the cursor rules cover, usage instructions, and project structure example. The related technology links are appropriate.

rules/hono-typescript-cloudflare-cursorrules-prompt-file/README.md (1)

1-59: Clear and comprehensive README for Hono Cloudflare Workers.

The documentation effectively describes the edge-first framework, covers relevant Cloudflare bindings (D1, KV, R2, Durable Objects), and provides appropriate usage guidance. The example project structure includes the essential wrangler.toml for Workers configuration.

rules/drizzle-orm-typescript-cursorrules-prompt-file/README.md (1)

1-63: Well-documented Drizzle ORM cursor rules README.

The documentation covers the essential aspects of Drizzle ORM development including schema design, type inference, migrations with Drizzle Kit, and the repository pattern. The example project structure appropriately shows the recommended organization for database layers.

rules/hono-typescript-cloudflare-cursorrules-prompt-file/.cursorrules (1)

1-256: Comprehensive and well-structured Hono cursor rules.

The prompt file provides excellent coverage of Hono development patterns including:

  • Proper type-safe bindings definitions
  • Zod validation with @hono/zod-validator
  • Middleware pattern using createMiddleware
  • Error handling with HTTPException
  • Cloudflare bindings usage (D1, KV, R2)

The code examples are idiomatic and demonstrate good TypeScript practices.

rules/bun-typescript-runtime-cursorrules-prompt-file/.cursorrules (1)

1-375: Excellent comprehensive Bun cursor rules.

The prompt file provides thorough coverage of Bun's unique capabilities including:

  • Native HTTP server with Bun.serve
  • File I/O with Bun.file() and Bun.write()
  • Built-in SQLite with transactions
  • Shell commands with Bun.$
  • Built-in password hashing with Argon2id
  • WebSocket server support
  • Native test runner with mocking

The "What to Avoid" section effectively guides users toward Bun-native solutions over Node.js alternatives.

rules/bun-typescript-runtime-cursorrules-prompt-file/README.md (1)

1-61: LGTM!

The README is well-structured with clear sections covering the purpose, tech stack, features, usage instructions, and project structure. The documentation follows the coding guidelines for clear and concise language with practical use cases.

rules/rust-actix-web-cursorrules-prompt-file/.cursorrules (1)

1-73: Well-structured Rust Actix Web guidelines.

The document provides comprehensive coverage of Actix Web patterns including clean architecture, error handling, authentication, middleware, and testing. The code examples demonstrate idiomatic Rust with proper async/await usage and type safety.

rules/drizzle-orm-typescript-cursorrules-prompt-file/.cursorrules (1)

1-85: Comprehensive Drizzle ORM documentation.

The file provides excellent coverage of Drizzle ORM patterns including schema design with Zod integration, type inference, relations, and index definitions. The naming conventions and file organization guidance are clear and practical.

rules/remix-react-typescript-cursorrules-prompt-file/.cursorrules (1)

1-57: Well-structured Remix guidelines with good coverage.

The documentation covers essential Remix patterns including route modules, data loading with defer/Await, form handling with Zod + Conform, authentication, and error boundaries. The emphasis on web standards and progressive enhancement aligns well with Remix's philosophy.

Comment on lines +162 to +168
### Security
- Always use `secureHeaders()` middleware
- Validate all input with Zod schemas
- Use parameterized queries for D1/SQL
- Implement rate limiting with `hono/rate-limiter`
- Set appropriate CORS policies

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

Hono rate limiter middleware import path official documentation

💡 Result:

There is no built-in rate-limiter in Hono core. The commonly used third‑party package is hono-rate-limiter — import examples from its docs:

  • Middleware: import { rateLimiter } from "hono-rate-limiter". [1][2]
  • Redis store (optional): import { RedisStore } from "@hono-rate-limiter/redis". [3][4]

Sources: npm / GitHub docs for hono-rate-limiter and @hono-rate-limiter/redis. [1] https://www.npmjs.com/package/hono-rate-limiter [2] https://github.com/rhinobase/hono-rate-limiter [3] https://www.npmjs.com/package/%40hono-rate-limiter/redis [4] https://jsr.io/%40hono-rate-limiter/redis


Correct the rate limiter import path.

The reference to hono/rate-limiter is incorrect. Hono has no built-in rate limiter. The correct third-party package is hono-rate-limiter with import: import { rateLimiter } from "hono-rate-limiter". Update line 166 to reflect this.

🤖 Prompt for AI Agents
In rules/hono-typescript-cloudflare-cursorrules-prompt-file/.cursorrules around
lines 162 to 168, the rate limiter import path is incorrect: change any mention
of "hono/rate-limiter" to use the third-party package by updating references to
import and usage to "hono-rate-limiter" (i.e., replace the import with import {
rateLimiter } from "hono-rate-limiter" and adjust any identifier names if needed
to match that export).

Comment on lines +285 to +313
### Resource Routes (API)
```typescript
// app/routes/api.users.tsx
import { json, type LoaderFunctionArgs } from '@remix-run/node'

export async function loader({ request }: LoaderFunctionArgs) {
const url = new URL(request.url)
const query = url.searchParams.get('q')

const users = await searchUsers(query)

return json(users, {
headers: {
'Cache-Control': 'public, max-age=60',
},
})
}

export async function action({ request }: ActionFunctionArgs) {
if (request.method !== 'POST') {
return json({ error: 'Method not allowed' }, { status: 405 })
}

const data = await request.json()
const user = await createUser(data)

return json(user, { status: 201 })
}
```
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Missing ActionFunctionArgs import in resource route example.

The action function at line 303 uses ActionFunctionArgs type, but this type is not included in the import statement at line 288.

 // app/routes/api.users.tsx
-import { json, type LoaderFunctionArgs } from '@remix-run/node'
+import { json, type LoaderFunctionArgs, type ActionFunctionArgs } from '@remix-run/node'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
### Resource Routes (API)
```typescript
// app/routes/api.users.tsx
import { json, type LoaderFunctionArgs } from '@remix-run/node'
export async function loader({ request }: LoaderFunctionArgs) {
const url = new URL(request.url)
const query = url.searchParams.get('q')
const users = await searchUsers(query)
return json(users, {
headers: {
'Cache-Control': 'public, max-age=60',
},
})
}
export async function action({ request }: ActionFunctionArgs) {
if (request.method !== 'POST') {
return json({ error: 'Method not allowed' }, { status: 405 })
}
const data = await request.json()
const user = await createUser(data)
return json(user, { status: 201 })
}
```
// app/routes/api.users.tsx
import { json, type LoaderFunctionArgs, type ActionFunctionArgs } from '@remix-run/node'
export async function loader({ request }: LoaderFunctionArgs) {
const url = new URL(request.url)
const query = url.searchParams.get('q')
const users = await searchUsers(query)
return json(users, {
headers: {
'Cache-Control': 'public, max-age=60',
},
})
}
export async function action({ request }: ActionFunctionArgs) {
if (request.method !== 'POST') {
return json({ error: 'Method not allowed' }, { status: 405 })
}
const data = await request.json()
const user = await createUser(data)
return json(user, { status: 201 })
}
🤖 Prompt for AI Agents
In rules/remix-react-typescript-cursorrules-prompt-file/.cursorrules around
lines 285 to 313, the resource route example's action function uses the
ActionFunctionArgs type but the top import only includes LoaderFunctionArgs;
update the import to include ActionFunctionArgs from '@remix-run/node'. Ensure
both types are imported in the same import statement and keep the rest of the
example unchanged.

Comment on lines +75 to +128
## Essential Dependencies (Cargo.toml)

```toml
[package]
name = "my-actix-app"
version = "0.1.0"
edition = "2021"
rust-version = "1.75"

[dependencies]
# Web framework
actix-web = "4"
actix-rt = "2"
actix-cors = "0.7"
actix-files = "0.6"

# Async runtime
tokio = { version = "1", features = ["full"] }

# Serialization
serde = { version = "1", features = ["derive"] }
serde_json = "1"

# Database
sqlx = { version = "0.8", features = ["runtime-tokio", "postgres", "uuid", "chrono", "migrate"] }

# Configuration
config = "0.14"
dotenvy = "0.15"

# Logging & Tracing
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
tracing-actix-web = "0.7"

# Validation
validator = { version = "0.18", features = ["derive"] }

# Security
argon2 = "0.5"
jsonwebtoken = "9"

# Utilities
uuid = { version = "1", features = ["v4", "serde"] }
chrono = { version = "0.4", features = ["serde"] }
thiserror = "1"
anyhow = "1"
once_cell = "1"

[dev-dependencies]
actix-rt = "2"
reqwest = { version = "0.12", features = ["json"] }
fake = "2"
```
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Missing num_cpus dependency in Cargo.toml.

The main.rs example at line 207 uses num_cpus::get() to configure workers, but the num_cpus crate is not listed in the dependencies section.

Add the missing dependency:

 # Utilities
 uuid = { version = "1", features = ["v4", "serde"] }
 chrono = { version = "0.4", features = ["serde"] }
 thiserror = "1"
 anyhow = "1"
 once_cell = "1"
+num_cpus = "1"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
## Essential Dependencies (Cargo.toml)
```toml
[package]
name = "my-actix-app"
version = "0.1.0"
edition = "2021"
rust-version = "1.75"
[dependencies]
# Web framework
actix-web = "4"
actix-rt = "2"
actix-cors = "0.7"
actix-files = "0.6"
# Async runtime
tokio = { version = "1", features = ["full"] }
# Serialization
serde = { version = "1", features = ["derive"] }
serde_json = "1"
# Database
sqlx = { version = "0.8", features = ["runtime-tokio", "postgres", "uuid", "chrono", "migrate"] }
# Configuration
config = "0.14"
dotenvy = "0.15"
# Logging & Tracing
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
tracing-actix-web = "0.7"
# Validation
validator = { version = "0.18", features = ["derive"] }
# Security
argon2 = "0.5"
jsonwebtoken = "9"
# Utilities
uuid = { version = "1", features = ["v4", "serde"] }
chrono = { version = "0.4", features = ["serde"] }
thiserror = "1"
anyhow = "1"
once_cell = "1"
[dev-dependencies]
actix-rt = "2"
reqwest = { version = "0.12", features = ["json"] }
fake = "2"
```
## Essential Dependencies (Cargo.toml)
🤖 Prompt for AI Agents
In rules/rust-actix-web-cursorrules-prompt-file/.cursorrules around lines 75 to
128, the Cargo.toml example is missing the num_cpus dependency referenced by
main.rs at line 207 where num_cpus::get() is used; add the num_cpus crate to the
[dependencies] section of Cargo.toml with a recent 1.x-compatible version so the
call compiles, then run cargo update/cargo build to verify.

Comment on lines +946 to +955
// Get JWT secret from app state
let secret = std::env::var("JWT_SECRET").unwrap_or_else(|_| "secret".to_string());

// Decode and validate token
let token_data = decode::<Claims>(
token,
&DecodingKey::from_secret(secret.as_bytes()),
&Validation::default(),
)
.map_err(|e| actix_web::error::ErrorUnauthorized(format!("Invalid token: {}", e)))?;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Security concern: Avoid fallback to hardcoded JWT secret.

Using a hardcoded fallback "secret" for JWT_SECRET is a security anti-pattern. If the environment variable is missing, the application should fail rather than silently using a weak secret that could allow token forgery.

Apply this diff to fail explicitly when the secret is missing:

-    let secret = std::env::var("JWT_SECRET").unwrap_or_else(|_| "secret".to_string());
+    let secret = std::env::var("JWT_SECRET")
+        .map_err(|_| actix_web::error::ErrorInternalServerError("JWT_SECRET not configured"))?;

Alternatively, validate the secret at application startup in main() to fail fast.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// Get JWT secret from app state
let secret = std::env::var("JWT_SECRET").unwrap_or_else(|_| "secret".to_string());
// Decode and validate token
let token_data = decode::<Claims>(
token,
&DecodingKey::from_secret(secret.as_bytes()),
&Validation::default(),
)
.map_err(|e| actix_web::error::ErrorUnauthorized(format!("Invalid token: {}", e)))?;
// Get JWT secret from app state
let secret = std::env::var("JWT_SECRET")
.map_err(|_| actix_web::error::ErrorInternalServerError("JWT_SECRET not configured"))?;
// Decode and validate token
let token_data = decode::<Claims>(
token,
&DecodingKey::from_secret(secret.as_bytes()),
&Validation::default(),
)
.map_err(|e| actix_web::error::ErrorUnauthorized(format!("Invalid token: {}", e)))?;
🤖 Prompt for AI Agents
rules/rust-actix-web-cursorrules-prompt-file/.cursorrules lines 946-955: The
code falls back to a hardcoded "secret" when JWT_SECRET is missing; change this
to fail explicitly instead of using a weak default. Replace unwrap_or_else with
retrieving the env var and returning an actix_web::error (or propagate a Result)
when missing, or ensure the secret is validated at startup (main) and the
process exits with a clear error if JWT_SECRET is not set; update the error
handling so token decoding only proceeds with a verified non-empty secret.

Comment on lines +19 to +21
- Actix Web consistently ranks #1 in TechEmpower benchmarks
- Multi-threaded async runtime with Tokio
- Zero-cost abstractions and minimal overhead
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

TechEmpower benchmarks Actix Web ranking 2024 2025

💡 Result:

Short answer:

  • TechEmpower Framework Benchmarks — Round 22 (published Nov 15, 2023): actix (actix-web) was one of the top performers (near the top of the leaderboard, effectively 2nd overall in the Round‑22 results). [1]
  • TechEmpower Framework Benchmarks — Round 23 (published Mar 17, 2025): actix remained among the highest‑performing frameworks (ranked in the top tier — reported as 3rd place on some composite/fortunes reports from Round‑23). [2]

Sources:

  1. TechEmpower — Framework Benchmarks Round 22 (announcement). [TechEmpower blog, Nov 15, 2023]. [1]
  2. TechEmpower — Framework Benchmarks Round 23 (announcement). [TechEmpower blog, Mar 17, 2025]. [2]

If you want exact per‑test numbers (plaintext/JSON/fortunes/composite) or a direct link to actix’s entry in the interactive results for each round, I can fetch and paste the exact rank and RPS values.


Modify benchmark claim for accuracy.

The README states "Actix Web consistently ranks #1 in TechEmpower benchmarks," but verification shows Actix ranked 2nd overall in Round 22 (Nov 2023) and 3rd in Round 23 (Mar 2025). Change to: "Actix Web is consistently among the top-performing frameworks in TechEmpower benchmarks" or specify the actual ranking from a particular round.

🤖 Prompt for AI Agents
In rules/rust-actix-web-cursorrules-prompt-file/README.md around lines 19 to 21,
the benchmark claim "Actix Web consistently ranks #1 in TechEmpower benchmarks"
is inaccurate; update the sentence to a correct, verifiable statement such as
"Actix Web is consistently among the top-performing frameworks in TechEmpower
benchmarks" or replace it with a specific, cited ranking (e.g., "ranked 2nd in
TechEmpower Round 22 (Nov 2023) and 3rd in Round 23 (Mar 2025)"), and include a
short citation or link to the TechEmpower results if available.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant