Struct TraceRejectionMiddleware 

pub struct TraceRejectionMiddleware { /* private fields */ }

Middleware that rejects HTTP TRACE requests to prevent Cross-Site Tracing (XST) attacks.

The HTTP TRACE method echoes the request back to the client, which can be exploited in XSS attacks to steal sensitive headers like Authorization or cookies.

Security Rationale

• TRACE can expose Authorization headers via XSS attacks
• No legitimate use case in modern APIs
• OWASP recommends disabling TRACE

Example

use fastapi_core::middleware::TraceRejectionMiddleware;

let app = App::builder()
    .middleware(TraceRejectionMiddleware::new())
    .build();

Behavior

• Returns 405 Method Not Allowed for all TRACE requests
• Logs TRACE attempts as security events (when log_attempts is true)
• Cannot be disabled per-route (intentionally)

Implementations

impl TraceRejectionMiddleware

pub fn new() -> Self

Create a new TRACE rejection middleware with default settings.

By default, logging of TRACE attempts is enabled.

pub fn log_attempts(self, log: bool) -> Self

Configure whether to log TRACE attempts.

When enabled, each TRACE request is logged as a security event including the remote IP (if available) and request path.

Trait Implementations

impl Clone for TraceRejectionMiddleware

fn clone(&self) -> TraceRejectionMiddleware

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TraceRejectionMiddleware

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TraceRejectionMiddleware

fn default() -> Self

Returns the “default value” for a type.

impl Middleware for TraceRejectionMiddleware

fn before<'a>( &'a self, _ctx: &'a RequestContext, req: &'a mut Request, ) -> BoxFuture<'a, ControlFlow>

Called before the handler executes.

fn name(&self) -> &'static str

Returns the middleware name for debugging and logging.

fn after<'a>( &'a self, _ctx: &'a RequestContext, _req: &'a Request, response: Response, ) -> BoxFuture<'a, Response>

Called after the handler executes.