本站的中间件栈

    // S2（风险 R4）：应用层 per-IP 限流，仅作用于 /api/*（auth / pay 更严）。
    // ...
    let router = router.layer(axum::middleware::from_fn(crate::server::rate_limit::rate_limit_mw));

    // G7：`/blog/` 这类尾斜杠地址 301 到 `/blog`，避免重复 URL。
    let router = router.layer(axum::middleware::from_fn(crate::server::seo::trailing_slash_mw));

    // G4：按 Accept-Encoding 压缩响应（br / gzip）。HTML、CSS、JS、wasm、
    // sitemap / feed 都受益；图片和流式 SSE 由默认判定跳过，已带
    // Content-Encoding 的响应不重复压缩。
    let router = router.layer(tower_http::compression::CompressionLayer::new());

    // S1（风险 R6）：全站安全响应头（CSP / nosniff / Referrer-Policy / X-Frame-Options）。
    // 挂在最外层，覆盖页面、server fn、静态资源与上面全部自定义路由（含 429 响应）。
    let router =
      router.layer(axum::middleware::from_fn(crate::server::security::security_headers_mw));

axum = "=0.8.9"
tower-http = { version = "=0.6.11", features = ["compression-gzip"] }
tower = { version = "=0.5.3", features = ["util"] }
tokio = { version = "=1.54.1", features = ["macros", "rt-multi-thread"] }

use std::sync::Mutex;

use axum::{
  Router,
  body::Body,
  extract::Request,
  http::{HeaderValue, StatusCode, header},
  middleware::{Next, from_fn},
  response::{IntoResponse, Redirect, Response},
  routing::get,
};
use tower::ServiceExt;
use tower_http::compression::CompressionLayer;

static TRACE: Mutex<Vec<&'static str>> = Mutex::new(Vec::new());
static TOKENS: Mutex<u32> = Mutex::new(0);

fn trace(step: &'static str) {
  TRACE.lock().unwrap().push(step);
}

fn take_token() -> bool {
  let mut tokens = TOKENS.lock().unwrap();
  let ok = *tokens > 0;
  if ok {
    *tokens -= 1;
  }
  ok
}

// 简化版 rate_limit_mw：只管 /api/*，整个进程共用 1 个令牌
async fn rate_limit_mw(req: Request, next: Next) -> Response {
  trace("rate_limit");
  if req.uri().path().starts_with("/api/") && !take_token() {
    return (StatusCode::TOO_MANY_REQUESTS, "请求过于频繁，请稍后重试").into_response();
  }
  next.run(req).await
}

// 简化版 trailing_slash_mw：GET /xxx/ 跳到 /xxx
async fn trailing_slash_mw(req: Request, next: Next) -> Response {
  trace("trailing_slash");
  let path = req.uri().path();
  if path.len() > 1 && path.ends_with('/') && !path.starts_with("/api/") {
    return Redirect::permanent(path.trim_end_matches('/')).into_response();
  }
  next.run(req).await
}

// 简化版 security_headers_mw：先跑内层，再补头
async fn security_headers_mw(req: Request, next: Next) -> Response {
  trace("security");
  let mut resp = next.run(req).await;
  resp.headers_mut().entry("x-frame-options").or_insert(HeaderValue::from_static("DENY"));
  resp
}

fn routes() -> Router {
  Router::new()
    .route("/api/x", get(|| async { trace("handler"); "x".repeat(100) }))
    .route("/blog", get(|| async { "blog" }))
}

async fn send(router: &Router, path: &str) {
  TRACE.lock().unwrap().clear();
  let req = Request::builder()
    .uri(path)
    .header(header::ACCEPT_ENCODING, "gzip")
    .body(Body::empty())
    .unwrap();
  let res = router.clone().oneshot(req).await.unwrap();
  let h = |name| res.headers().get(name).and_then(|v| v.to_str().ok()).unwrap_or("-").to_string();
  println!(
    "  {path:<8} {} enc={:<4} xfo={:<4} order={:?}",
    res.status().as_u16(),
    h("content-encoding"),
    h("x-frame-options"),
    TRACE.lock().unwrap()
  );
}

async fn run(name: &str, router: Router) {
  println!("{name}");
  *TOKENS.lock().unwrap() = 1;
  for path in ["/api/x", "/api/x", "/blog/"] {
    send(&router, path).await;
  }
}

#[tokio::main]
async fn main() {
  // 和 main.rs 相同的顺序：先加的在里层
  let site = routes()
    .layer(from_fn(rate_limit_mw))
    .layer(from_fn(trailing_slash_mw))
    .layer(CompressionLayer::new())
    .layer(from_fn(security_headers_mw));
  run("site order (security outermost):", site).await;

  // 反例：安全头最先加，落在最里层
  let inner = routes()
    .layer(from_fn(security_headers_mw))
    .layer(from_fn(rate_limit_mw))
    .layer(from_fn(trailing_slash_mw))
    .layer(CompressionLayer::new());
  run("security innermost:", inner).await;
}

use std::time::Duration;

use axum::{Router, routing::get};
use tower::limit::RateLimitLayer;

fn main() {
  let _router: Router = Router::new()
    .route("/api/x", get(|| async { "x" }))
    .layer(RateLimitLayer::new(20, Duration::from_secs(1)));
}

error[E0277]: the trait bound `RateLimit<Route>: Clone` is not satisfied
   --> src/bin/ratelimit_layer.rs:9:12
    |
  9 |     .layer(RateLimitLayer::new(20, Duration::from_secs(1)));
    |      ----- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the trait `Clone` is not implemented for `RateLimit<Route>`
    |      |
    |      required by a bound introduced by this call
    |
note: required by a bound in `Router::<S>::layer`
   --> axum-0.8.9/src/routing/mod.rs:306:40
    |
303 |     pub fn layer<L>(self, layer: L) -> Router<S>
    |            ----- required by a bound in this associated function
...
306 |         L::Service: Service<Request> + Clone + Send + Sync + 'static,
    |                                        ^^^^^ required by this bound in `Router::<S>::layer`

For more information about this error, try `rustc --explain E0277`.
error: could not compile `exp-tower-site` (bin "ratelimit_layer") due to 1 previous error

use std::{
  sync::{
    Arc,
    atomic::{AtomicU32, Ordering},
  },
  task::{Context, Poll},
};

use axum::{Router, body::Body, extract::Request, routing::get};
use tower::{Layer, Service, ServiceExt};

// 一个把计数存在自己身上的中间件，像 tower::limit::RateLimit 那样
#[derive(Clone)]
struct Count<S> {
  inner: S,
  local: u32,              // 每个实例自己的计数
  shared: Arc<AtomicU32>,  // 所有副本共用的计数
}

#[derive(Clone)]
struct CountLayer(Arc<AtomicU32>);

impl<S> Layer<S> for CountLayer {
  type Service = Count<S>;
  fn layer(&self, inner: S) -> Count<S> {
    Count { inner, local: 0, shared: self.0.clone() }
  }
}

impl<S: Service<Request>> Service<Request> for Count<S> {
  type Response = S::Response;
  type Error = S::Error;
  type Future = S::Future;
  fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), S::Error>> {
    self.inner.poll_ready(cx)
  }
  fn call(&mut self, req: Request) -> S::Future {
    self.local += 1;
    let shared = self.shared.fetch_add(1, Ordering::SeqCst) + 1;
    println!("  {} local={} shared={}", req.uri().path(), self.local, shared);
    self.inner.call(req)
  }
}

fn req(path: &str) -> Request {
  Request::builder().uri(path).body(Body::empty()).unwrap()
}

#[tokio::main]
async fn main() {
  println!("same Router (with_state), three requests:");
  let mut router = Router::new()
    .route("/a", get(|| async {}))
    .route("/b", get(|| async {}))
    .layer(CountLayer(Arc::new(AtomicU32::new(0))))
    .with_state(()); // 先把 layer 套好，排除「每次请求重新套」
  let mut svc = router.as_service::<Body>();
  for path in ["/a", "/a", "/b"] {
    svc.ready().await.unwrap().call(req(path)).await.unwrap();
  }
}

same Router (with_state), three requests:
  /a local=1 shared=1
  /a local=1 shared=2
  /b local=1 shared=3

  fn acquire_in(&self, map: &mut HashMap<String, Bucket>, key: &str, now: Instant) -> bool {
    let bucket = map.entry(key.to_string()).or_insert(Bucket { tokens: self.burst, last: now });
    let dt = now.duration_since(bucket.last).as_secs_f64();
    bucket.tokens = (bucket.tokens + dt * self.rps).min(self.burst);
    bucket.last = now;
    if bucket.tokens >= 1.0 {
      bucket.tokens -= 1.0;
      true
    } else {
      false
    }
  }

site order (security outermost):
  /api/x   200 enc=gzip xfo=DENY order=["security", "trailing_slash", "rate_limit", "handler"]
  /api/x   429 enc=gzip xfo=DENY order=["security", "trailing_slash", "rate_limit"]
  /blog/   308 enc=-    xfo=DENY order=["security", "trailing_slash"]
security innermost:
  /api/x   200 enc=gzip xfo=DENY order=["trailing_slash", "rate_limit", "security", "handler"]
  /api/x   429 enc=gzip xfo=-    order=["trailing_slash", "rate_limit"]
  /blog/   308 enc=-    xfo=-    order=["trailing_slash"]