Struct WebSocketSecurityConfig 

pub struct WebSocketSecurityConfig { /* private fields */ }

Configuration for WebSocket security.

This provides a unified way to configure security for WebSocket endpoints, combining authentication requirements and origin validation.

Spring Security Equivalent

WebSocketSecurityConfigurer / AbstractSecurityWebSocketMessageBrokerConfigurer

Example

use actix_security::http::security::websocket::WebSocketSecurityConfig;

// Create configuration
let ws_config = WebSocketSecurityConfig::new()
    .allowed_origins(vec!["https://myapp.com".into()])
    .require_authentication(true)
    .required_roles(vec!["USER".into()]);

// Use in handler
#[get("/ws")]
async fn ws_handler(
    req: HttpRequest,
    stream: web::Payload,
    config: web::Data<WebSocketSecurityConfig>,
) -> Result<HttpResponse, actix_web::Error> {
    let upgrade = config.validate_upgrade(&req)?;
    // ... upgrade to WebSocket
}

Implementations

impl WebSocketSecurityConfig

pub fn new() -> Self

Creates a new WebSocket security configuration with default settings.

Default settings:

• No origin validation (allow any)
• Authentication not required
• No role/authority requirements

pub fn allowed_origins(self, origins: Vec<String>) -> Self

Sets the allowed origins for WebSocket connections.

Arguments

• origins - List of allowed origin URLs

Example

let config = WebSocketSecurityConfig::new()
    .allowed_origins(vec!["https://myapp.com".into()]);

pub fn origin_validator(self, validator: OriginValidator) -> Self

Sets a custom origin validator.

Example

let validator = OriginValidator::builder()
    .allow("https://myapp.com")
    .allow_localhost_in_dev(true)
    .build();

let config = WebSocketSecurityConfig::new()
    .origin_validator(validator);

pub fn require_authentication(self, require: bool) -> Self

Requires authentication for WebSocket connections.

When enabled, unauthenticated WebSocket upgrade requests will be rejected.

Example

let config = WebSocketSecurityConfig::new()
    .require_authentication(true);

pub fn required_roles(self, roles: Vec<String>) -> Self

Sets required roles for WebSocket connections.

Users must have at least one of the specified roles. Automatically enables authentication requirement.

Example

let config = WebSocketSecurityConfig::new()
    .required_roles(vec!["USER".into(), "ADMIN".into()]);

pub fn required_authorities(self, authorities: Vec<String>) -> Self

Sets required authorities for WebSocket connections.

Users must have at least one of the specified authorities. Automatically enables authentication requirement.

Example

let config = WebSocketSecurityConfig::new()
    .required_authorities(vec!["ws:connect".into()]);

pub fn validate_upgrade( &self, req: &HttpRequest, ) -> Result<WebSocketUpgrade, WebSocketSecurityError>

Validates a WebSocket upgrade request.

This method performs all configured security checks:

1. Origin validation (CSWSH prevention)
2. Authentication check (if required)
3. Role check (if configured)
4. Authority check (if configured)

Returns

• Ok(WebSocketUpgrade) - Validation passed, safe to upgrade
• Err(WebSocketSecurityError) - Validation failed

Example

let config = WebSocketSecurityConfig::new()
    .allowed_origins(vec!["https://myapp.com".into()])
    .require_authentication(true);

#[get("/ws")]
async fn ws_handler(req: HttpRequest, stream: web::Payload) -> Result<HttpResponse, Error> {
    let upgrade = config.validate_upgrade(&req)?;
    let user = upgrade.into_user().unwrap();
    // ... upgrade to WebSocket
}

Trait Implementations

impl Clone for WebSocketSecurityConfig

fn clone(&self) -> WebSocketSecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WebSocketSecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for WebSocketSecurityConfig

fn default() -> Self

Returns the “default value” for a type.