Struct SecurityConfig 

pub struct SecurityConfig {
    pub allowed_origins: Vec<String>,
}

Browser-facing defenses for the local proxy.

Loopback is not a boundary against the browser: any page the operator visits can POST to 127.0.0.1 as a CORS simple request, which is sent without a preflight. CORS blocks reading the reply, but the request has already spent the budget and can poison the cache.

Fields

allowed_origins: Vec<String>

Origins permitted to drive the proxy from a browser, matched exactly against the Origin header. Empty (the default) accepts no cross-origin browser traffic; non-browser clients send no such header and are unaffected either way.

The literal "*" disables the check entirely, re-opening the CSRF hole for every page the operator visits.

Implementations

impl SecurityConfig

pub fn origin_allowed(&self, origin: &str) -> bool

True when origin may drive the proxy from a browser.

pub fn allows_any_origin(&self) -> bool

True when the operator has opened the proxy to every origin, which is the only case where browser-origin signals are ignored.

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> SecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> SecurityConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecurityConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecurityConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.