Struct SecurityHeadersConfig 

pub struct SecurityHeadersConfig {
    pub x_content_type_options: Option<&'static str>,
    pub x_frame_options: Option<XFrameOptions>,
    pub x_xss_protection: Option<&'static str>,
    pub content_security_policy: Option<String>,
    pub hsts: Option<(u64, bool, bool)>,
    pub referrer_policy: Option<ReferrerPolicy>,
    pub permissions_policy: Option<String>,
}

Configuration for the Security Headers middleware.

All headers are optional. Set a value to Some(...) to include the header, or None to skip it.

Defaults

The default configuration provides secure defaults:

• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• X-XSS-Protection: 0 (disabled as modern browsers have built-in protection)
• Referrer-Policy: strict-origin-when-cross-origin

Example

use fastapi_core::middleware::{SecurityHeadersConfig, XFrameOptions, ReferrerPolicy};

let config = SecurityHeadersConfig::default()
    .x_frame_options(XFrameOptions::SameOrigin)
    .content_security_policy("default-src 'self'")
    .hsts(31536000, true);  // 1 year, includeSubDomains

Fields

x_content_type_options: Option<&'static str>

X-Content-Type-Options header. Default: Some("nosniff")

x_frame_options: Option<XFrameOptions>

X-Frame-Options header. Default: Some(XFrameOptions::Deny)

x_xss_protection: Option<&'static str>

X-XSS-Protection header. Default: Some("0") (disabled - modern browsers have built-in protection)

Note: This header is largely obsolete. Setting it to “0” is recommended to prevent potential security issues in older browsers.

content_security_policy: Option<String>

Content-Security-Policy header. Default: None (should be configured based on your application)

hsts: Option<(u64, bool, bool)>

Strict-Transport-Security (HSTS) header. Tuple of (max_age_seconds, include_sub_domains, preload) Default: None (only set this for HTTPS-only sites)

referrer_policy: Option<ReferrerPolicy>

Referrer-Policy header. Default: Some(ReferrerPolicy::StrictOriginWhenCrossOrigin)

permissions_policy: Option<String>

Permissions-Policy header (formerly Feature-Policy). Default: None (should be configured based on your application)

Implementations

impl SecurityHeadersConfig

pub fn new() -> Self

Creates a new configuration with secure defaults.

pub fn none() -> Self

Creates an empty configuration (no headers).

pub fn strict() -> Self

Creates a strict configuration for high-security applications.

Includes:

• All default headers
• HSTS with 1 year max-age and includeSubDomains
• A basic CSP that only allows same-origin resources

pub fn x_content_type_options(self, value: Option<&'static str>) -> Self

Sets the X-Content-Type-Options header.

pub fn x_frame_options(self, value: Option<XFrameOptions>) -> Self

Sets the X-Frame-Options header.

pub fn x_xss_protection(self, value: Option<&'static str>) -> Self

Sets the X-XSS-Protection header.

pub fn content_security_policy(self, value: impl Into<String>) -> Self

Sets the Content-Security-Policy header.

pub fn no_content_security_policy(self) -> Self

Clears the Content-Security-Policy header.

pub fn hsts( self, max_age: u64, include_sub_domains: bool, preload: bool, ) -> Self

Sets the Strict-Transport-Security (HSTS) header.

Arguments

• max_age: Maximum time (in seconds) the browser should remember HTTPS
• include_sub_domains: Whether to apply to all subdomains
• preload: Whether to include in browser preload lists (use with caution)

Warning

Only enable HSTS for sites that are HTTPS-only. Enabling HSTS incorrectly can make your site inaccessible.

pub fn no_hsts(self) -> Self

Clears the HSTS header.

pub fn referrer_policy(self, value: Option<ReferrerPolicy>) -> Self

Sets the Referrer-Policy header.

pub fn permissions_policy(self, value: impl Into<String>) -> Self

Sets the Permissions-Policy header.

pub fn no_permissions_policy(self) -> Self

Clears the Permissions-Policy header.

Trait Implementations

impl Clone for SecurityHeadersConfig

fn clone(&self) -> SecurityHeadersConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityHeadersConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityHeadersConfig

fn default() -> Self

Returns the “default value” for a type.