Struct SecurityHeaders 

pub struct SecurityHeaders {
    pub content_type_options: bool,
    pub frame_options: FrameOptions,
    pub xss_protection: bool,
    pub content_security_policy: Option<String>,
    pub hsts_enabled: bool,
    pub hsts_max_age: u64,
    pub hsts_include_subdomains: bool,
    pub hsts_preload: bool,
    pub referrer_policy: ReferrerPolicy,
    pub permissions_policy: Option<String>,
    pub cache_control: Option<String>,
}

Security headers configuration.

Spring Security Equivalent

HttpSecurity.headers()

Example

use actix_security_core::http::security::headers::{SecurityHeaders, FrameOptions};

let headers = SecurityHeaders::new()
    .frame_options(FrameOptions::SameOrigin)
    .content_security_policy("default-src 'self'")
    .hsts(true, 31536000); // 1 year

Fields

content_type_options: bool

X-Content-Type-Options header (default: nosniff)

frame_options: FrameOptions

X-Frame-Options header (default: DENY)

xss_protection: bool

X-XSS-Protection header (default: 0)

content_security_policy: Option<String>

Content-Security-Policy header (default: None)

hsts_enabled: bool

Strict-Transport-Security header (default: disabled)

hsts_max_age: u64

HSTS max-age in seconds (default: 31536000 = 1 year)

hsts_include_subdomains: bool

HSTS include subdomains (default: false)

hsts_preload: bool

HSTS preload (default: false)

referrer_policy: ReferrerPolicy

Referrer-Policy header (default: strict-origin-when-cross-origin)

permissions_policy: Option<String>

Permissions-Policy header (default: None)

cache_control: Option<String>

Cache-Control header for sensitive content (default: None)

Implementations

impl SecurityHeaders

pub fn new() -> Self

Creates a new security headers configuration with defaults.

pub fn strict() -> Self

Creates a strict security headers configuration.

Enables all security headers with strict values.

pub fn frame_options(self, options: FrameOptions) -> Self

Sets the X-Frame-Options header.

Spring Security Equivalent

headers().frameOptions().deny() or .sameOrigin()

pub fn content_security_policy(self, policy: impl Into<String>) -> Self

Sets the Content-Security-Policy header.

Spring Security Equivalent

headers().contentSecurityPolicy("policy")

Example

let headers = SecurityHeaders::new()
    .content_security_policy("default-src 'self'; script-src 'self' 'unsafe-inline'");

pub fn hsts(self, enabled: bool, max_age: u64) -> Self

Enables HTTP Strict Transport Security (HSTS).

Spring Security Equivalent

headers().httpStrictTransportSecurity()

Arguments

• enabled - Whether to enable HSTS
• max_age - Max-age value in seconds

pub fn hsts_include_subdomains(self, include: bool) -> Self

Sets HSTS to include subdomains.

pub fn hsts_preload(self, preload: bool) -> Self

Sets HSTS preload flag.

Warning

Only enable this if you’ve submitted your domain to the HSTS preload list.

pub fn referrer_policy(self, policy: ReferrerPolicy) -> Self

Sets the Referrer-Policy header.

Spring Security Equivalent

headers().referrerPolicy(ReferrerPolicy.STRICT_ORIGIN)

pub fn permissions_policy(self, policy: impl Into<String>) -> Self

Sets the Permissions-Policy header.

Example

let headers = SecurityHeaders::new()
    .permissions_policy("geolocation=(), microphone=(), camera=()");

pub fn cache_control(self, value: impl Into<String>) -> Self

Sets the Cache-Control header for sensitive content.

pub fn disable_content_type_options(self) -> Self

Disables X-Content-Type-Options header.

Trait Implementations

impl Clone for SecurityHeaders

fn clone(&self) -> SecurityHeaders

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityHeaders

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityHeaders

fn default() -> Self

Creates security headers with sensible defaults.

Default Values

• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• X-XSS-Protection: 0 (disabled as recommended)
• Referrer-Policy: strict-origin-when-cross-origin

impl<S, B> Transform<S, ServiceRequest> for SecurityHeaders

where S: Service<ServiceRequest, Response = ServiceResponse<B>, Error = Error> + 'static, B: 'static,

type Response = ServiceResponse<B>

Responses produced by the service.

type Error = Error

Errors produced by the service.

type Transform = SecurityHeadersMiddleware<S>

The TransformService value created by this factory

type InitError = ()

Errors produced while building a transform service.

type Future = Ready<Result<<SecurityHeaders as Transform<S, ServiceRequest>>::Transform, <SecurityHeaders as Transform<S, ServiceRequest>>::InitError>>

The future response value.

fn new_transform(&self, service: S) -> Self::Future

Creates and returns a new Transform component, asynchronously