Module security_headers 

Security headers management, ported from the reference handler.

The engine owns the logic; adapters (and the conformance runner) apply the returned map to their responses. security_headers ports get_headers resolved against a security_headers dict: a disabled configuration yields no headers, the class defaults apply, the configured overrides replace the matching class header, the CSP and HSTS blocks extend them, and the custom headers land last.

Reference sources: security_headers_handler.py, its config mixin (_security_headers_config.py), and the field defaults (_security_config_fields.py).

Example

use guard_core_engine::security_headers::{security_headers, SecurityHeadersConfig};

// The reference default block: the class defaults plus the
// max-age=31536000; includeSubDomains HSTS header.
let headers = security_headers(&SecurityHeadersConfig::reference_default());
assert_eq!(headers.get("X-Content-Type-Options").map(String::as_str), Some("nosniff"));
assert_eq!(
    headers.get("Strict-Transport-Security").map(String::as_str),
    Some("max-age=31536000; includeSubDomains")
);

// Disabled: no headers at all (the reference `get_headers` early return).
let off = SecurityHeadersConfig {
    enabled: false,
    ..SecurityHeadersConfig::default()
};
assert!(security_headers(&off).is_empty());

Structs

CspDirective

One Content-Security-Policy directive with its sources, in the insertion order the reference dict keeps (a Vec keeps the built header deterministic).

HstsConfig

The reference security_headers["hsts"] block: max_age, include_subdomains, preload.

SecurityHeadersConfig

The reference security_headers dict: enabled, hsts, csp, frame_options, content_type_options, xss_protection, referrer_policy, permissions_policy, and custom.

Enums

SecurityHeadersError

A rejected security-headers configuration: the reference raises out of configure(), so a deployment never starts with these values.

Constants

CLASS_DEFAULT_HEADERS

SecurityHeadersManager.default_headers, in table order.

Functions

build_csp

_build_csp: “directive source1 source2” joined with “; “, bare directives kept when they carry no sources.

build_hsts

_build_hsts plus the _compute_hsts_config preload corrections.

is_valid_header_name

_HEADER_NAME_TOKEN_RE: a non-empty RFC 7230 token.

security_headers

SecurityHeadersManager.get_headers resolved against the reference security_headers dict.

validate_header_value

_validate_header_value: no CR/LF, at most 8192 bytes, control characters below 0x20 dropped except tab.