rustbasic-core 0.1.26

Core framework logic for RustBasic - A modern web framework for Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

use crate::requests::Request;
use crate::middleware::Next;
use crate::router::Response;
use http::header;

pub async fn security_headers_middleware(
    req: Request,
    next: Next,
) -> Response {
    let mut response = next.run(req).await;
    
    let headers = response.headers_mut();
    
    // 1. Mencegah Clickjacking (SAMEORIGIN adalah standar industri untuk fleksibilitas internal)
    headers.insert(header::X_FRAME_OPTIONS, "SAMEORIGIN".parse().unwrap());
    
    // 2. Mencegah MIME Sniffing
    headers.insert(header::X_CONTENT_TYPE_OPTIONS, "nosniff".parse().unwrap());
    
    // 3. XSS Protection (untuk kompatibilitas browser lama)
    headers.insert(header::X_XSS_PROTECTION, "1; mode=block".parse().unwrap());
    
    // 4. Referrer Policy (Standar modern untuk keamanan kebocoran URL referrer)
    headers.insert(header::REFERRER_POLICY, "strict-origin-when-cross-origin".parse().unwrap());
    
    // 5. Permissions Policy (Membatasi akses API sensor hardware sensitif)
    headers.insert(
        http::header::HeaderName::from_static("permissions-policy"),
        "camera=(self), microphone=(self), geolocation=(self), payment=()".parse().unwrap()
    );
    
    let cfg = crate::Config::load();
    
    // 6. Strict-Transport-Security (HSTS - Wajib HTTPS di mode Produksi)
    if !cfg.app_debug {
        headers.insert(
            header::STRICT_TRANSPORT_SECURITY,
            "max-age=31536000; includeSubDomains; preload".parse().unwrap()
        );
    }
    let csp = if cfg.app_debug {
        let port = cfg.vite_port;
        let host = &cfg.app_host;
        let extra_hosts = if host != "0.0.0.0" && host != "127.0.0.1" && host != "localhost" && !host.is_empty() {
            format!("http://{}:{} ws://{}:{} ", host, port, host, port)
        } else {
            "".to_string()
        };

        format!(
            "default-src 'self'; \
             script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:{} http://127.0.0.1:{} {}https:; \
             style-src 'self' 'unsafe-inline' http://localhost:{} http://127.0.0.1:{} {}https:; \
             font-src 'self' https: data:; \
             img-src 'self' data: https:; \
             frame-src 'self' https:; \
             media-src 'self' https:; \
             object-src 'self' https:; \
             connect-src 'self' ws://localhost:{} ws://127.0.0.1:{} http://localhost:{} http://127.0.0.1:{} {}https:;",
            port, port, extra_hosts,
            port, port, extra_hosts,
            port, port, port, port, extra_hosts
        )
    } else {
        "default-src 'self'; \
         script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; \
         style-src 'self' 'unsafe-inline' https:; \
         font-src 'self' https: data:; \
         img-src 'self' data: https:; \
         frame-src 'self' https:; \
         media-src 'self' https:; \
         object-src 'self' https:; \
         connect-src 'self' https:;".to_string()
    };
    headers.insert(header::CONTENT_SECURITY_POLICY, csp.parse().unwrap());
    
    response
}