Struct SecurityHeaders 

pub struct SecurityHeaders { /* private fields */ }

Which security headers to add, and with what values.

None for any field disables that header. Defaults:

Header	Default
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
Referrer-Policy	no-referrer
Strict-Transport-Security	max-age=31536000, only when TLS is configured
Permissions-Policy	sensors and high-risk features locked off (see below)
Cross-Origin-Resource-Policy	same-origin
Content-Security-Policy	off

There is no default Content-Security-Policy on purpose: a useful one is application-specific, and a generic one either breaks pages or is so permissive that it implies protection it does not give.

The default Permissions-Policy disables camera, microphone, geolocation, payment, USB, and interest-cohort (FLoC) access. JSON APIs never need those browser features, and an HTML app that does can override the header.

Cross-Origin-Resource-Policy: same-origin blocks no-cors cross-origin reads (Spectre-class resource loading). Cross-origin clients that use CORS still work; only opaque cross-origin embedding is refused.

Implementations

impl SecurityHeaders

pub fn new() -> Self

The default set. Equivalent to SecurityHeaders::default.

pub fn content_type_options(self, v: Option<&str>) -> Self

Set or disable X-Content-Type-Options.

pub fn frame_options(self, v: Option<&str>) -> Self

Set or disable X-Frame-Options.

pub fn referrer_policy(self, v: Option<&str>) -> Self

Set or disable Referrer-Policy.

pub fn hsts(self, v: Option<&str>) -> Self

Set or disable Strict-Transport-Security.

Only sent when the response is known to be going out over TLS. Announcing HSTS over plaintext tells a client nothing it can trust, and behind a terminating proxy it can pin a hostname to HTTPS the origin does not actually serve.

Two things establish that knowledge. Over TCP it is AppBuilder::tls: this process holding the certificate is what rules out a plaintext hop in front of it. Over HTTP/3 nothing needs to be configured, because QUIC has no plaintext mode — server_config_from_pem pins TLS 1.3 — so an h3 response is encrypted whether or not the builder was ever told about a certificate.

pub fn content_security_policy(self, v: Option<&str>) -> Self

Set a Content-Security-Policy. Off by default.

pub fn permissions_policy(self, v: Option<&str>) -> Self

Set or disable Permissions-Policy (formerly Feature-Policy).

pub fn cross_origin_resource_policy(self, v: Option<&str>) -> Self

Set or disable Cross-Origin-Resource-Policy.

Default same-origin. Use cross-origin only when you deliberately serve assets for no-cors embedding from other sites.

Trait Implementations

impl Clone for SecurityHeaders

fn clone(&self) -> SecurityHeaders

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityHeaders

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityHeaders

fn default() -> Self

Returns the “default value” for a type.