1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
//! Spring Security-style protection for Autumn applications.
//!
//! This module provides automatic security hardening that follows OWASP
//! best practices. Like Spring Security, it applies sensible defaults
//! out of the box and can be customized via `autumn.toml`.
//!
//! ## What's included
//!
//! | Component | Module | Description |
//! |-----------|--------|-------------|
//! | Security headers | `headers` | X-Frame-Options, X-Content-Type-Options, HSTS, CSP, etc. |
//! | CSRF protection | `csrf` | Token-based CSRF validation for mutating requests |
//! | Rate limiting | `rate_limit` | Per-client-IP token-bucket throttling with `429` + `Retry-After` |
//! | Configuration | `config` | `[security]` section in `autumn.toml` |
//!
//! Authentication, session management, and password hashing live in
//! their own top-level modules ([`crate::auth`], [`crate::session`]).
//!
//! ## Profile-aware defaults
//!
//! Like Spring Security's auto-configuration, Autumn adjusts security
//! settings based on the active profile:
//!
//! | Setting | `dev` | `prod` |
//! |---------|-------|--------|
//! | Security headers | Applied (all defaults) | Applied (all defaults + HSTS) |
//! | CSRF protection | Disabled | Enabled |
//! | HSTS | Off | On (1 year, includeSubDomains) |
//! | Session cookies | Not Secure | Secure |
//!
//! ## Configuration
//!
//! ```toml
//! [security.headers]
//! x_frame_options = "DENY" # or "SAMEORIGIN", "" to disable
//! x_content_type_options = true # X-Content-Type-Options: nosniff
//! xss_protection = true # X-XSS-Protection: 1; mode=block
//! strict_transport_security = true # HSTS (auto-enabled in prod)
//! hsts_max_age_secs = 31536000 # 1 year
//! content_security_policy = "default-src 'self'; ..." # htmx-friendly default; "" disables
//! referrer_policy = "strict-origin-when-cross-origin"
//! permissions_policy = "" # set to enable Permissions-Policy
//!
//! [security.csrf]
//! enabled = true # auto-enabled in prod
//! token_header = "X-CSRF-Token"
//! cookie_name = "autumn-csrf"
//!
//! [security.rate_limit]
//! enabled = true # per-IP token bucket
//! requests_per_second = 10.0
//! burst = 20
//! trust_forwarded_headers = true # only behind trusted proxies
//! trusted_proxies = ["10.0.0.10", "203.0.113.0/24"]
//! ```
//!
//! ## Quick start
//!
//! Security headers are applied automatically -- no setup needed.
//! For CSRF protection in templates:
//!
//! ```rust,ignore
//! use autumn_web::prelude::*;
//! use autumn_web::security::CsrfToken;
//!
//! #[get("/form")]
//! async fn form(csrf: CsrfToken) -> Markup {
//! html! {
//! form method="POST" action="/submit" {
//! input type="hidden" name="_csrf" value=(csrf.token());
//! input type="text" name="title";
//! button { "Submit" }
//! }
//! }
//! }
//! ```
pub
pub
pub
pub
// Re-export commonly used types at the module level.
pub use ;
pub use ;
pub use SecurityHeadersLayer;
pub use RateLimitLayer;