Struct SecurityHeaders 

pub struct SecurityHeaders { /* private fields */ }

Which security headers to add, and with what values.

None for any field disables that header. Defaults:

Header	Default
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
Referrer-Policy	no-referrer
Strict-Transport-Security	max-age=31536000, only when TLS is configured
Content-Security-Policy	off

There is no default Content-Security-Policy on purpose: a useful one is application-specific, and a generic one either breaks pages or is so permissive that it implies protection it does not give.

Implementations

impl SecurityHeaders

pub fn new() -> Self

The default set. Equivalent to SecurityHeaders::default.

pub fn content_type_options(self, v: Option<&str>) -> Self

Set or disable X-Content-Type-Options.

pub fn frame_options(self, v: Option<&str>) -> Self

Set or disable X-Frame-Options.

pub fn referrer_policy(self, v: Option<&str>) -> Self

Set or disable Referrer-Policy.

pub fn hsts(self, v: Option<&str>) -> Self

Set or disable Strict-Transport-Security.

Only sent when the response is known to be going out over TLS. Announcing HSTS over plaintext tells a client nothing it can trust, and behind a terminating proxy it can pin a hostname to HTTPS the origin does not actually serve.

Two things establish that knowledge. Over TCP it is AppBuilder::tls: this process holding the certificate is what rules out a plaintext hop in front of it. Over HTTP/3 nothing needs to be configured, because QUIC has no plaintext mode — server_config_from_pem pins TLS 1.3 — so an h3 response is encrypted whether or not the builder was ever told about a certificate.

pub fn content_security_policy(self, v: Option<&str>) -> Self

Set a Content-Security-Policy. Off by default.

Trait Implementations

impl Clone for SecurityHeaders

fn clone(&self) -> SecurityHeaders

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityHeaders

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityHeaders

fn default() -> Self

Returns the “default value” for a type.