Struct SecurityHeaders 

pub struct SecurityHeaders { /* private fields */ }

Middleware that adds security-related HTTP headers to responses.

This middleware helps protect against common web vulnerabilities by setting appropriate security headers. It’s recommended for all web applications.

Headers

• X-Content-Type-Options: Prevents MIME type sniffing
• X-Frame-Options: Controls iframe embedding (clickjacking protection)
• X-XSS-Protection: Legacy XSS filter control (disabled by default)
• Content-Security-Policy: Controls resource loading
• Strict-Transport-Security: Enforces HTTPS
• Referrer-Policy: Controls referrer information
• Permissions-Policy: Controls browser features

Example

use fastapi_core::middleware::{SecurityHeaders, SecurityHeadersConfig};

// Use defaults
let mw = SecurityHeaders::new();

// Custom configuration
let config = SecurityHeadersConfig::default()
    .content_security_policy("default-src 'self'; img-src *")
    .hsts(86400, false, false);  // 1 day

let mw = SecurityHeaders::with_config(config);

Implementations

impl SecurityHeaders

pub fn new() -> Self

Creates a new middleware with default configuration.

pub fn with_config(config: SecurityHeadersConfig) -> Self

Creates a new middleware with custom configuration.

pub fn strict() -> Self

Creates a middleware with strict security settings.

Trait Implementations

impl Clone for SecurityHeaders

fn clone(&self) -> SecurityHeaders

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityHeaders

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityHeaders

fn default() -> Self

Returns the “default value” for a type.

impl Middleware for SecurityHeaders

fn after<'a>( &'a self, _ctx: &'a RequestContext, _req: &'a Request, response: Response, ) -> BoxFuture<'a, Response>

Called after the handler executes.

fn name(&self) -> &'static str

Returns the middleware name for debugging and logging.

fn before<'a>( &'a self, _ctx: &'a RequestContext, _req: &'a mut Request, ) -> BoxFuture<'a, ControlFlow>

Called before the handler executes.