churust-core 0.3.0

Core engine, routing, pipeline, and extractors for the Churust web framework.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140

//! Security response headers, applied by default.

use churust_core::{Call, Churust, Response, SecurityHeaders, TestClient};
use http::StatusCode;

#[tokio::test]
async fn defaults_are_applied_without_being_asked_for() {
    let app = Churust::server()
        .routing(|r| {
            r.get("/", |_c: Call| async { "hi" });
        })
        .build();

    let res = TestClient::new(app).get("/").send().await;
    assert_eq!(res.status(), StatusCode::OK);
    assert_eq!(res.header("x-content-type-options"), Some("nosniff"));
    assert_eq!(res.header("x-frame-options"), Some("DENY"));
    assert_eq!(res.header("referrer-policy"), Some("no-referrer"));
}

#[tokio::test]
async fn hsts_is_absent_without_tls() {
    let app = Churust::server()
        .routing(|r| {
            r.get("/", |_c: Call| async { "hi" });
        })
        .build();

    let res = TestClient::new(app).get("/").send().await;
    assert!(
        res.header("strict-transport-security").is_none(),
        "HSTS over plaintext is meaningless and harmful behind a terminating proxy"
    );
}

#[tokio::test]
async fn a_handler_that_sets_its_own_header_wins() {
    let app = Churust::server()
        .routing(|r| {
            r.get("/", |_c: Call| async {
                Response::text("framed").with_header(
                    http::header::X_FRAME_OPTIONS,
                    http::HeaderValue::from_static("SAMEORIGIN"),
                )
            });
        })
        .build();

    let res = TestClient::new(app).get("/").send().await;
    assert_eq!(
        res.header("x-frame-options"),
        Some("SAMEORIGIN"),
        "the application must be able to override a default"
    );
    // The others are still filled in.
    assert_eq!(res.header("x-content-type-options"), Some("nosniff"));
}

#[tokio::test]
async fn headers_can_be_turned_off_entirely() {
    let app = Churust::server()
        .without_security_headers()
        .routing(|r| {
            r.get("/", |_c: Call| async { "hi" });
        })
        .build();

    let res = TestClient::new(app).get("/").send().await;
    assert!(res.header("x-content-type-options").is_none());
    assert!(res.header("x-frame-options").is_none());
    assert!(res.header("referrer-policy").is_none());
}

#[tokio::test]
async fn individual_headers_can_be_disabled() {
    let app = Churust::server()
        .security_headers(SecurityHeaders::new().frame_options(None))
        .routing(|r| {
            r.get("/", |_c: Call| async { "hi" });
        })
        .build();

    let res = TestClient::new(app).get("/").send().await;
    assert!(res.header("x-frame-options").is_none());
    assert_eq!(res.header("x-content-type-options"), Some("nosniff"));
}

#[tokio::test]
async fn values_can_be_customised() {
    let app = Churust::server()
        .security_headers(
            SecurityHeaders::new()
                .referrer_policy(Some("strict-origin-when-cross-origin"))
                .content_security_policy(Some("default-src 'self'")),
        )
        .routing(|r| {
            r.get("/", |_c: Call| async { "hi" });
        })
        .build();

    let res = TestClient::new(app).get("/").send().await;
    assert_eq!(
        res.header("referrer-policy"),
        Some("strict-origin-when-cross-origin")
    );
    assert_eq!(
        res.header("content-security-policy"),
        Some("default-src 'self'"),
        "CSP is off by default but must be settable"
    );
}

#[tokio::test]
async fn no_csp_by_default() {
    let app = Churust::server()
        .routing(|r| {
            r.get("/", |_c: Call| async { "hi" });
        })
        .build();

    let res = TestClient::new(app).get("/").send().await;
    assert!(
        res.header("content-security-policy").is_none(),
        "a default CSP either breaks apps or is so permissive it misleads"
    );
}

#[tokio::test]
async fn error_responses_are_also_protected() {
    let app = Churust::server()
        .routing(|r| {
            r.get("/", |_c: Call| async { "hi" });
        })
        .build();

    // A 404 is still a response an attacker can reach.
    let res = TestClient::new(app).get("/missing").send().await;
    assert_eq!(res.status(), StatusCode::NOT_FOUND);
    assert_eq!(res.header("x-content-type-options"), Some("nosniff"));
}