Struct HttpOptions

Source

pub struct HttpOptions {
    pub request_timeout: Duration,
    pub body_size_limit: usize,
    pub concurrency_limit: usize,
    pub allow_credentials: bool,
    /* private fields */
}

Expand description

Configuration for the shared HTTP layer stack.

CORS denies cross-origin access until explicit origins are supplied through HttpOptions::with_allowed_origins. Wildcard origins are rejected, which also prevents the invalid wildcard-with-credentials combination.

Fields§

§request_timeout: Duration

Maximum time allowed for one request, including concurrency queueing.

§body_size_limit: usize

Maximum accepted request body size in bytes.

§concurrency_limit: usize

Maximum number of requests processed concurrently.

§allow_credentials: bool

Whether browsers may send credentials to explicitly allowed origins.

Implementations§

Source §

impl HttpOptions

Source

pub fn with_allowed_origins<I, S>( self, origins: I, ) -> Result<Self, HttpOptionsError>
where I: IntoIterator<Item = S>, S: AsRef<str>,

Replaces the CORS origin allowlist.

Each origin must be a valid HTTP header value and must not be *.

Source

pub fn allowed_origins(&self) -> &[HeaderValue]

Returns the explicit CORS origin allowlist.

Source

pub fn with_additional_allowed_headers<I, S>( self, headers: I, ) -> Result<Self, HttpOptionsError>
where I: IntoIterator<Item = S>, S: AsRef<str>,

Adds request headers to the standard CORS allowlist.

The built-in Authorization, Content-Type, If-Match, Idempotency-Key, x-request-id, traceparent, and tracestate headers remain allowed. Duplicate header names are ignored.

Source

pub fn additional_allowed_headers(&self) -> &[HeaderName]

Returns the request headers added to the standard CORS allowlist.

Source

pub fn with_additional_exposed_headers<I, S>( self, headers: I, ) -> Result<Self, HttpOptionsError>
where I: IntoIterator<Item = S>, S: AsRef<str>,

Adds response headers to the standard CORS exposed set.

The built-in x-request-id, traceparent, tracestate, Retry-After, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, ETag, and Location headers remain exposed. Duplicate header names are ignored.

Source

pub fn additional_exposed_headers(&self) -> &[HeaderName]

Returns the response headers added to the standard CORS exposed set.

Source

pub const fn with_response_cache_policy( self, policy: ResponseCachePolicy, ) -> Self

Replaces the response cache policy.

The default is ResponseCachePolicy::PrivateNoStore.

Source

pub const fn response_cache_policy(&self) -> ResponseCachePolicy

Returns the response cache policy.

Source

pub fn with_json_rejection_code( self, code: impl Into<String>, ) -> Result<Self, HttpOptionsError>

Overrides the error code returned when crate::ApiJson rejects a body.

The default is validation_failed. The replacement must be a non-empty snake_case identifier.

Source

pub fn with_json_rejection_codes(self, codes: JsonRejectionCodes) -> Self

Enables class-specific JSON rejection statuses and codes.

This preserves Axum’s protocol statuses, including 413 Payload Too Large, 415 Unsupported Media Type, and 422 Unprocessable Entity.

Source

pub fn json_rejection_code(&self) -> &str

Returns the single JSON rejection code in compatibility mode.

In class-specific mode this returns the data-shape code to preserve the existing return type. Use HttpOptions::json_rejection_codes to read all four codes.

Source