Struct SecurityHeaders 

pub struct SecurityHeaders { /* private fields */ }

Middleware that adds security headers to every response.

Ships OWASP-recommended defaults out of the box. Each header can be overridden or disabled via the builder API.

HSTS is off by default because it breaks localhost over HTTP. Call with_hsts to enable it in production.

Example

use ferro::SecurityHeaders;

// Use defaults (safe for development)
global_middleware!(SecurityHeaders::new());

// Production: enable HSTS
global_middleware!(SecurityHeaders::new().with_hsts());

// Custom overrides
global_middleware!(
    SecurityHeaders::new()
        .x_frame_options("SAMEORIGIN")
        .without("Permissions-Policy")
);

Implementations

impl SecurityHeaders

pub fn new() -> Self

Create with OWASP-recommended defaults.

All headers except HSTS are enabled. HSTS is off by default to avoid breaking development over HTTP.

pub fn with_hsts(self) -> Self

Enable HSTS with max-age=31536000; includeSubDomains (no preload).

Safe for production use. Does not include preload because preload submission is permanent and affects all subdomains.

pub fn with_hsts_preload(self) -> Self

Enable HSTS with preload directive.

Only use this if you intend to submit your domain to the HSTS preload list. Preload is permanent — removing a domain takes months.

pub fn without_hsts(self) -> Self

Disable HSTS (same as default, for explicitness).

pub fn x_frame_options(self, value: impl Into<String>) -> Self

Override the X-Frame-Options header value.

Default is DENY. Use SAMEORIGIN to allow framing from the same origin.

pub fn content_security_policy(self, value: impl Into<String>) -> Self

Override the Content-Security-Policy header value.

pub fn referrer_policy(self, value: impl Into<String>) -> Self

Override the Referrer-Policy header value.

pub fn permissions_policy(self, value: impl Into<String>) -> Self

Override the Permissions-Policy header value.

pub fn cross_origin_opener_policy(self, value: impl Into<String>) -> Self

Override the Cross-Origin-Opener-Policy header value.

pub fn without(self, header_name: &str) -> Self

Disable a specific header by name.

The name is matched case-insensitively.

Example

SecurityHeaders::new()
    .without("X-Frame-Options")
    .without("Permissions-Policy");

Trait Implementations

impl Default for SecurityHeaders

fn default() -> Self

Returns the “default value” for a type.

impl Middleware for SecurityHeaders

fn handle<'life0, 'async_trait>( &'life0 self, request: Request, next: Next, ) -> Pin<Box<dyn Future<Output = Response> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Handle the request