tower-http

tower-http provides a large collection of ready-made Service/Layer middleware built on the tower ecosystem, covering the HTTP cross-cutting concerns almost every server or client needs: compression and decompression, CORS, request tracing, timeouts, authentication, sensitive-header redaction, request ID propagation, path normalization, and more. Because everything implements Tower’s standard Service/Layer traits, these middlewares compose with any Tower-compatible framework or client — most commonly axum and hyper — via tower::ServiceBuilder.

Rather than each framework reimplementing compression or CORS handling itself, tower-http centralizes these concerns as reusable, independently-versioned building blocks that any Tower-based HTTP stack can opt into per-feature via Cargo feature flags.

What You Get

• Compression/decompression middleware supporting gzip, brotli, deflate, and zstd
• CorsLayer for configuring cross-origin resource sharing headers declaratively
• TraceLayer for structured request/response tracing integrated with the tracing crate
• Auth-adjacent middleware: RequireAuthorizationLayer, sensitive-header redaction, and CSRF helpers
• Operational middleware: TimeoutLayer, RequestIdLayer, CatchPanicLayer, path normalization, and metrics hooks
• Everything implemented as standard Tower Service/Layers, composable via tower::ServiceBuilder with any Tower-compatible framework

Common Use Cases

• Adding gzip/brotli response compression to an axum or hyper server with a single ServiceBuilder layer
• Configuring CORS for a Rust API consumed by a browser-based frontend without hand-writing header logic
• Instrumenting every request/response with structured tracing spans for observability
• Redacting sensitive headers (Authorization, Cookie) from logs while still tracing requests
• Adding consistent timeouts, panic recovery, and request-ID propagation across every route in a service

Under The Hood

Architecture — The crate is organized as one middleware family per top-level module under tower-http/src/ — compression/, decompression/, cors/, trace/, auth/, csrf/, follow_redirect/, metrics/, set_header/, timeout/, and standalone files like catch_panic.rs, normalize_path.rs, request_id.rs, and sensitive_headers.rs — each exposing a Layer type that wraps an inner Tower Service. service_ext.rs provides a ServiceBuilderExt trait that adds ergonomic .trace_for_http()/.compression()-style methods directly onto tower::ServiceBuilder, so consumers rarely construct layer types by hand.

Tech Stack — Pure Rust (edition 2018, MSRV 1.65), built directly on the Tower ecosystem: tower-layer/tower-service for the middleware contract, http/bytes for HTTP types, pin-project-lite for safe pinned futures, and bitflags for compact option sets. Nearly every middleware family is gated behind its own Cargo feature flag, so consumers pay compile-time and dependency cost only for the middleware they actually enable.

Code Quality — Each middleware module ships its own focused unit tests colocated with the implementation, plus test-files/ fixtures used by the compression/decompression tests to verify round-tripping across gzip/brotli/deflate/zstd. deny.toml enforces dependency/license auditing via cargo-deny in CI, and the project has sustained very active, well-maintained development (350M+ cumulative downloads, frequent releases) as one of the standard middleware crates for the axum/Tower ecosystem.

API Design — The ServiceBuilderExt trait is the primary ergonomic surface: chaining .layer(CompressionLayer::new()).layer(CorsLayer::permissive()).layer(TraceLayer::new_for_http()) reads as a declarative middleware stack rather than nested wrapper types, and most layers ship sensible ::new() or preset constructors (CorsLayer::permissive()) so getting started requires minimal configuration. Because every middleware follows the same Layer/Service shape, learning one (e.g. CompressionLayer) transfers directly to using any other in the crate.