WebAssembly at the edge: when Wasm beats containers for serverless and CDN logic

#!/usr/bin/env bash
set -euo pipefail
rustup target add wasm32-unknown-unknown
cargo install cargo-generate worker-build
cargo generate cloudflare/workers-rs --name edge-auth-worker
cd edge-auth-worker

use base64::{
    engine::general_purpose::URL_SAFE_NO_PAD,
    Engine,
};
use serde::Deserialize;
use worker::*;

#[derive(Deserialize)]
struct JwtClaims {
    sub: String,
    exp: Option<u64>,
    scope: Option<String>,
}

#[event(fetch)]
async fn main(req: Request, _env: Env, _ctx: Context) -> Result<Response> {
    let auth = match req.headers().get("Authorization")? {
        Some(value) => value,
        None => return Response::error("Missing Authorization", 401),
    };

    let token = match auth.strip_prefix("Bearer ") {
        Some(value) if !value.is_empty() => value,
        _ => return Response::error("Invalid Authorization", 401),
    };

    let claims = match decode_claims(token) {
        Ok(claims) => claims,
        Err(_) => return Response::error("Invalid or expired token", 403),
    };

    // Production: verify signature with a JWT library, then proxy to origin.
    Response::from_json(&serde_json::json!({
        "ok": true,
        "user": claims.sub,
        "scope": claims.scope,
    }))
}

fn decode_claims(token: &str) -> Result<JwtClaims> {
    let mut parts = token.split('.');
    let (_header, payload, _sig) = match (parts.next(), parts.next(), parts.next(), parts.next()) {
        (Some(h), Some(p), Some(s), None) if !h.is_empty() && !p.is_empty() && !s.is_empty() => {
            (h, p, s)
        }
        _ => return Err(Error::RustError("malformed jwt".into())),
    };

    let bytes = URL_SAFE_NO_PAD
        .decode(payload)
        .map_err(|_| Error::RustError("jwt payload decode".into()))?;
    let claims: JwtClaims =
        serde_json::from_slice(&bytes).map_err(|_| Error::RustError("jwt json".into()))?;

    if let Some(exp) = claims.exp {
        let now = Date::now().as_millis() as u64 / 1000;
        if exp < now {
            return Err(Error::RustError("expired".into()));
        }
    }

    Ok(claims)
}

[package]
name = "edge-auth-worker"
version = "0.1.0"
edition = "2021"

[lib]
crate-type = ["cdylib"]

[dependencies]
worker = "0.5"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
base64 = "0.22"

[profile.release]
lto = true
strip = true
codegen-units = 1

name = "edge-auth-worker"
main = "build/worker/shim.mjs"
compatibility_date = "2026-01-01"

[build]
command = "cargo install -q worker-build && worker-build --release"

[[routes]]
pattern = "api.example.com/*"
zone_name = "example.com"

#!/usr/bin/env bash
set -euo pipefail
rustup target add wasm32-wasip1
cargo build --target wasm32-wasip1 --release
wasm-opt -O3 --strip-debug --strip-producers \
  target/wasm32-wasip1/release/edge_auth_worker.wasm \
  -o dist/edge-auth-worker.wasm
ls -lh dist/edge-auth-worker.wasm