Crate toolkit_http 

HTTP client infrastructure for ToolKit

This crate provides a hyper-based HTTP client with:

• Automatic TLS via rustls; transport security is configurable via TransportSecurity — defaults to TlsOnly (HTTPS-only) under --features fips, AllowInsecureHttp otherwise
• Connection pooling
• Configurable timeouts
• Automatic retries with exponential backoff
• User-Agent header injection
• Concurrency limiting
• Transparent response decompression (gzip, brotli, deflate)
• Optional OpenTelemetry tracing (feature-gated)

Transparent Decompression

The client automatically:

• Sends Accept-Encoding: gzip, br, deflate header on all requests
• Decompresses response bodies based on Content-Encoding header
• Applies body size limits to decompressed bytes (protecting against zip bombs)

No configuration is required; decompression is always enabled.

Example

use toolkit_http::{HttpClient, HttpClientBuilder};
use std::time::Duration;

let client = HttpClient::builder()
    .timeout(Duration::from_secs(10))
    .user_agent("my-app/1.0")
    .build()?;

// reqwest-like API: response has body-reading methods
// Compressed responses are automatically decompressed
let data: MyData = client
    .get("https://example.com/api")
    .send()
    .await?
    .json()
    .await?;

Re-exports

pub use security::attach_bearer_http;

pub use security::attach_internal_token_http;

Modules

otel

OpenTelemetry trace context helpers for HTTP headers.

security

HTTP security utilities.

Structs

ClientAuthConfig

TLS building blocks shared with other transport crates (e.g. the upstream proxy engine) so every outbound ClientConfig goes through the same provider selection and FIPS hardening. TLS building blocks shared with other transport crates (e.g. the upstream proxy engine) so every outbound ClientConfig goes through the same provider selection and FIPS hardening. TLS building blocks shared with other transport crates (e.g. the upstream proxy engine) so every outbound ClientConfig goes through the same provider selection and FIPS hardening. Client-certificate (mutual TLS) identity.

ExponentialBackoff

Exponential backoff configuration for retries

HttpClient

HTTP client with tower middleware stack

HttpClientBuilder

Builder for constructing an [HttpClient] with a layered tower middleware stack.

HttpClientConfig

Overall HTTP client configuration

HttpResponse

HTTP response wrapper with body-reading helpers

LimitedBody

Body wrapper that enforces size limits during streaming.

MetricsLayer

Tower layer recording HTTP client request-duration metrics.

MetricsService

Service that records a duration metric for each outbound request.

OtelLayer

Tower layer that adds OpenTelemetry tracing to outbound HTTP requests

OtelService

Service that wraps requests with OpenTelemetry tracing spans

RateLimitConfig

Concurrency-limit configuration.

RedirectConfig

Configuration for redirect behavior

RequestBuilder

HTTP request builder with fluent API

RequestType

Per-request label for the request_type metrics attribute.

RetryConfig

Retry policy configuration with exponential backoff

RetryLayer

Tower layer that implements retry with exponential backoff and jitter

RetryService

Service that implements retry logic with exponential backoff

SecureRedirectPolicy

A security-hardened redirect policy

TlsConfig

TLS building blocks shared with other transport crates (e.g. the upstream proxy engine) so every outbound ClientConfig goes through the same provider selection and FIPS hardening. TLS building blocks shared with other transport crates (e.g. the upstream proxy engine) so every outbound ClientConfig goes through the same provider selection and FIPS hardening. TLS building blocks shared with other transport crates (e.g. the upstream proxy engine) so every outbound ClientConfig goes through the same provider selection and FIPS hardening. TLS handshake configuration for the HTTP client.

UserAgentLayer

Tower layer that adds User-Agent header to all requests

UserAgentService

Service that adds User-Agent header to requests

Enums

HttpError

HTTP client error types

InvalidUriKind

Classification of URL validation failures.

RetryTrigger

Conditions that trigger a retry

TlsConfigError

Error type returned by the fallible TLS-config builders in this gear.

TlsRootConfig

TLS root certificate configuration

TlsVersion

TLS building blocks shared with other transport crates (e.g. the upstream proxy engine) so every outbound ClientConfig goes through the same provider selection and FIPS hardening. TLS building blocks shared with other transport crates (e.g. the upstream proxy engine) so every outbound ClientConfig goes through the same provider selection and FIPS hardening. TLS building blocks shared with other transport crates (e.g. the upstream proxy engine) so every outbound ClientConfig goes through the same provider selection and FIPS hardening. Minimum TLS protocol version the client will negotiate.

TransportSecurity

Transport security configuration

Constants

DEFAULT_USER_AGENT

Default User-Agent string for HTTP requests

IDEMPOTENCY_KEY_HEADER

Standard idempotency key header name (display form)

RETRY_ATTEMPT_HEADER

Header name for retry attempt number (1-indexed). Added to retried requests to indicate which retry attempt this is.

Functions

custom_roots_client_config

Build a rustls ClientConfig trusting exactly root_store (e.g. a private CA for internal upstreams).

default_classify

Default classifier producing "METHOD host" (mirrors go-appkit’s default summary). Never returns a raw path, so it cannot blow up cardinality.

is_idempotent_method

Check if HTTP method is idempotent (safe to retry) per RFC 9110.

native_roots_client_config

Build a rustls ClientConfig using the cached native root certificates.

webpki_roots_client_config

Build a rustls ClientConfig using Mozilla’s webpki-roots trust anchors.

Type Aliases

ClassifyFn

Classifies a request into a low-cardinality route label (the http.route attribute). Set once when the client is built; invoked on every request.

ResponseBody

Type alias for the boxed response body that supports decompression.