Struct SecureHeader 

pub struct SecureHeader {
    pub enable: bool,
    pub preset: String,
    pub overrides: Option<BTreeMap<String, String>>,
}

Sets a predefined or custom set of secure headers.

We recommend our github preset. Presets values are derived from the secure_headers Ruby library which Github (and originally Twitter) use.

To use a preset, in your config/development.yaml:

middlewares:
  secure_headers:
    preset: github

You can also override individual headers on a given preset:

middlewares:
  secure_headers:
    preset: github
    overrides:
      foo: bar

Or start from scratch:

 middlewares:
   secure_headers:
     preset: empty
     overrides:
       one: two

To support htmx, You can add the following override, to allow some inline running of scripts:

secure_headers:
    preset: github
    overrides:
        # this allows you to use HTMX, and has unsafe-inline. Remove or consider in production
        "Content-Security-Policy": "default-src 'self' https:; font-src 'self' https: data:; img-src 'self' https: data:; object-src 'none'; script-src 'unsafe-inline' 'self' https:; style-src 'self' https: 'unsafe-inline'"

For the list of presets and their content look at secure_headers.json

Fields

enable: bool

preset: String

overrides: Option<BTreeMap<String, String>>

Trait Implementations

impl Clone for SecureHeader

fn clone(&self) -> SecureHeader

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecureHeader

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecureHeader

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecureHeader

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl MiddlewareLayer for SecureHeader

fn name(&self) -> &'static str

Returns the name of the middleware

fn is_enabled(&self) -> bool

Returns whether the middleware is enabled or not

fn apply(&self, app: AXRouter<AppContext>) -> Result<AXRouter<AppContext>>

Applies the secure headers layer to the application router

fn config(&self) -> Result<Value>

Returns middleware config.

impl Serialize for SecureHeader

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.