# Rust Web Framework Research: Actix vs Axum

**Date**: 2026-02-14
**Project**: Normogen - Health Data Tracking Platform
**Goal**: Select Rust web framework for zero-knowledge encrypted API

---

## Research Questions

### Core Requirements for Normogen
1. **Zero-knowledge encryption** - Client-side encryption before server storage
2. **High performance** - Health data processing and aggregation
3. **Type safety** - Critical for healthcare data integrity
4. **Async/await** - For database operations and external API calls
5. **WebSocket support** - Real-time health sensor data
6. **Middleware ecosystem** - Authentication, rate limiting, logging
7. **Database integration** - MongoDB with encryption layer
8. **Security track record** - Critical for health data

---

## Framework Contenders

### 1. Actix Web
**Maturity**: Production-ready since 2017
**Version**: 4.x (stable)
**Based on**: Actix actor framework

**Pros**:
- Proven performance in production
- Large ecosystem and community
- Extensive middleware support
- WebSocket support built-in
- Rich documentation and tutorials
- Powerful extractors system

**Cons**:
- Based on actor model (may be overkill)
- Heavier than alternatives
- Some criticism of unsafe code usage (historically)
- More complex mental model

**Key Questions**:
- How does it handle async database operations?
- What's the middleware story for authentication?
- Performance benchmarks for JSON APIs?
- Memory safety guarantees?

---

### 2. Axum
**Maturity**: Stable since 2021
**Version**: 0.7+ (actively developed)
**Based on**: Tower and Tokio

**Pros**:
- Modern async/await from ground up
- Tower middleware ecosystem (shared with Tonic, Hyper)
- Type-safe routing and extractors
- Simpler mental model
- Built on Tokio (excellent async runtime)
- Growing ecosystem
- Less boilerplate

**Cons**:
- Younger than Actix
- Smaller ecosystem (but growing fast)
- Some advanced features require extra crates
- Less battle-tested in large production systems

**Key Questions**:
- Tower middleware ecosystem maturity?
- Performance comparison to Actix?
- WebSocket support quality?
- MongoDB integration examples?

---

## Decision Criteria for Normogen

### 1. Performance
- Request/response throughput
- Memory efficiency
- Concurrent connection handling
- JSON serialization overhead

### 2. Async Capabilities
- Database connection pooling
- Multiple concurrent database queries
- External API calls (health integrations)
- Background task processing

### 3. Middleware & Authentication
- JWT middleware availability
- Custom authentication flows
- Request logging and tracing
- Rate limiting

### 4. Database Integration
- MongoDB driver compatibility
- Connection pooling
- Transaction support
- Query builder/ORM integration

### 5. Developer Experience
- Error handling ergonomics
- Testing support
- Documentation quality
- Community size and responsiveness

### 6. Security Track Record
- CVE history
- Memory safety guarantees
- Security audit results
- Adoption in security-critical applications

### 7. Real-time Features
- WebSocket support quality
- SSE (Server-Sent Events)
- Connection management
- Scaling real-time connections

---

## Research Needed

### Performance Benchmarks
- TechEmpower Framework Benchmarks 2025
- Real-world performance comparisons
- Memory usage under load
- WebSocket performance

### Community & Ecosystem
- GitHub stars and activity
- Crate maintenance status
- Available middleware crates
- Third-party integrations

### MongoDB Integration
- Available MongoDB drivers
- Connection pooling libraries
- ODM options
- Encryption layer integration

### Authentication Libraries
- JWT crate compatibility
- OAuth2/OpenID Connect support
- Session management options
- Custom auth flow examples

### WebSocket Implementation
- Quality of WebSocket implementations
- Connection stability
- Message throughput
- Scaling strategies

---

## Comparison Matrix

| Feature | Actix Web | Axum |
|---------|-----------|------|
| Performance | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ |
| Learning Curve | ⭐⭐⭐ | ⭐⭐⭐⭐ |
| Ecosystem | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ |
| Modern Async | ⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ |
| Middleware | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ |
| Documentation | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ |
| WebSocket | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ |
| Type Safety | ⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ |
| Simplicity | ⭐⭐⭐ | ⭐⭐⭐⭐⭐ |

---

## Open Questions

### For Actix:
1. How complex is the actor model for simple REST APIs?
2. What's the memory safety story with unsafe code?
3. Is the performance gain worth the complexity?
4. How well does it integrate with Tower middleware?

### For Axum:
1. Is Tower middleware mature enough for production?
2. What's the performance delta vs Actix?
3. Are there enough third-party crates?
4. How stable is the API long-term?

---

## Research Tasks

- [ ] Search for 2024-2025 performance benchmarks
- [ ] Review MongoDB integration patterns for both
- [ ] Examine authentication middleware options
- [ ] Check WebSocket implementation quality
- [ ] Look for health/medical projects using each
- [ ] Review security audit results
- [ ] Examine error handling patterns
- [ ] Check testing framework integration

---

## Sources to Research

1. Official documentation for both frameworks
2. TechEmpower Framework Benchmarks
3. GitHub repositories and issues
4. Reddit/rust and Discord community discussions
5. Blog posts from Rust developers
6. Case studies from production deployments
7. Security advisories and CVE reports
8. Crates.io download statistics

---

## Next Steps

Once research is complete, we'll create a scorecard based on:
- Performance (25%)
- Developer Experience (25%)
- Ecosystem Maturity (20%)
- Security Track Record (15%)
- Async/Database Integration (15%)

**Target Decision Date**: TBD
**Decision Maker**: Project team consensus