Struct SecurityConfig

Source

pub struct SecurityConfig {Show 131 fields
    pub trusted_proxies: Vec<String>,
    pub trusted_proxy_depth: u32,
    pub trust_x_forwarded_proto: bool,
    pub passive_mode: bool,
    pub geo_ip_handler: Option<Arc<dyn GeoIpHandler>>,
    pub enable_redis: bool,
    pub redis_url: Option<String>,
    pub redis_prefix: String,
    pub redis_socket_connect_timeout: Option<f64>,
    pub redis_socket_timeout: Option<f64>,
    pub redis_health_check_interval: u64,
    pub redis_max_connections: Option<u64>,
    pub redis_retries: u32,
    pub whitelist: Option<Vec<String>>,
    pub blacklist: Vec<String>,
    pub exempt_ips: Vec<String>,
    pub whitelist_countries: BTreeSet<String>,
    pub blocked_countries: BTreeSet<String>,
    pub blocked_user_agents: Vec<String>,
    pub auto_ban_threshold: u32,
    pub auto_ban_duration: u64,
    pub threat_ban_config: BTreeMap<String, ThreatBanEntry>,
    pub enable_rate_limit_auto_ban: bool,
    pub global_behavior_rules: Vec<BehaviorRule>,
    pub behavior_scan_response_body: bool,
    pub behavior_max_response_body_inspect_bytes: usize,
    pub body_read_timeout: f64,
    pub sync_body_read_max_concurrent: usize,
    pub custom_log_file: Option<String>,
    pub log_suspicious_level: Option<LogLevel>,
    pub log_request_level: Option<LogLevel>,
    pub log_country_check_level: Option<LogLevel>,
    pub log_format: LogFormat,
    pub custom_error_responses: BTreeMap<u16, String>,
    pub rate_limit: u32,
    pub rate_limit_window: u64,
    pub enforce_https: bool,
    pub security_headers: SecurityHeadersConfig,
    pub custom_request_check: Option<CustomRequestFn>,
    pub auth_verifier: Option<AuthVerifier>,
    pub custom_response_modifier: Option<ResponseModifierFn>,
    pub on_block: Option<OnBlockHook>,
    pub on_error: Option<OnErrorFn>,
    pub enable_cors: bool,
    pub cors_allow_origins: Vec<String>,
    pub cors_allow_methods: Vec<String>,
    pub cors_allow_headers: Vec<String>,
    pub cors_allow_credentials: bool,
    pub cors_expose_headers: Vec<String>,
    pub cors_max_age: u64,
    pub block_cloud_providers: Option<BTreeSet<String>>,
    pub cloud_ip_refresh_interval: u64,
    pub lazy_init: bool,
    pub geo_ip_db_max_age: u64,
    pub cloud_ip_store: Option<Arc<dyn CloudRangeStore>>,
    pub exclude_paths: Vec<String>,
    pub enable_ip_banning: bool,
    pub enable_rate_limiting: bool,
    pub enable_penetration_detection: bool,
    pub fail_secure: bool,
    pub redis_fail_open: bool,
    pub route_resolution_strict: bool,
    pub ipinfo_token: Option<String>,
    pub ipinfo_db_path: Option<PathBuf>,
    pub enable_agent: bool,
    pub agent_api_key: Option<String>,
    pub agent_strict: bool,
    pub agent_endpoint: String,
    pub agent_project_id: Option<String>,
    pub agent_buffer_size: usize,
    pub agent_flush_interval: u64,
    pub agent_enable_events: bool,
    pub agent_enable_metrics: bool,
    pub agent_timeout: u64,
    pub agent_retry_attempts: u32,
    pub agent_project_encryption_key: Option<String>,
    pub agent_guard_version: Option<String>,
    pub agent_high_watermark_ratio: Option<f64>,
    pub agent_max_concurrent_flushes: Option<u64>,
    pub agent_buffer_overflow_policy: Option<BufferOverflowPolicy>,
    pub agent_backoff_factor: Option<f64>,
    pub agent_sensitive_headers: Option<Vec<String>>,
    pub agent_max_payload_size: Option<u64>,
    pub agent_compression_enabled: Option<bool>,
    pub agent_compression_threshold: Option<u64>,
    pub agent_install_id: Option<String>,
    pub agent_payload_signing_secret: Option<String>,
    pub enable_dynamic_rules: bool,
    pub dynamic_rule_interval: u64,
    pub dynamic_rules_cache_path: Option<PathBuf>,
    pub agent_status_interval: u64,
    pub emergency_mode: bool,
    pub emergency_whitelist: Vec<String>,
    pub endpoint_rate_limits: BTreeMap<String, (u32, u64)>,
    pub detection_compiler_timeout: f64,
    pub detection_max_scan_seconds: f64,
    pub detection_pattern_validation_cache_path: Option<String>,
    pub detection_max_content_length: usize,
    pub detection_max_body_inspect_bytes: usize,
    pub detection_max_scan_values: usize,
    pub detection_max_scan_chars: usize,
    pub detection_max_json_depth: usize,
    pub detection_binary_min_run_length: usize,
    pub detection_preserve_attack_patterns: bool,
    pub detection_semantic_threshold: f64,
    pub detection_anomaly_threshold: f64,
    pub detection_slow_pattern_threshold: f64,
    pub detection_monitor_history_size: usize,
    pub detection_max_tracked_patterns: usize,
    pub detection_anomaly_emission_cooldown: f64,
    pub detection_min_samples_for_anomaly: usize,
    pub detection_threat_score_threshold: f64,
    pub muted_event_types: BTreeSet<String>,
    pub muted_metric_types: BTreeSet<String>,
    pub muted_check_logs: BTreeSet<String>,
    pub log_sensitive_headers: BTreeSet<String>,
    pub log_sensitive_params: BTreeSet<String>,
    pub log_sensitive_body_fields: BTreeSet<String>,
    pub enable_otel: bool,
    pub otel_service_name: String,
    pub otel_exporter_endpoint: Option<String>,
    pub otel_resource_attributes: BTreeMap<String, String>,
    pub enable_logfire: bool,
    pub logfire_service_name: String,
    pub enable_enrichment: bool,
    pub excluded_detection_headers: BTreeSet<String>,
    pub excluded_semantic_detection_headers: BTreeSet<String>,
    pub excluded_detection_params: BTreeSet<String>,
    pub excluded_detection_body_fields: BTreeSet<String>,
    pub detection_scan_body: bool,
    pub enabled_detection_categories: BTreeSet<String>,
}

Expand description

The unified configuration surface (the reference SecurityConfig).

Construct with SecurityConfig::default (every field at the reference default) or ..Default::default() struct-update, then SecurityConfig::validate before use.

Fields§

§trusted_proxies: Vec<String>

trusted_proxies: proxy IPs or CIDR ranges for X-Forwarded-For (the literal unix is additionally accepted, the reference’s allow_unix).

§trusted_proxy_depth: u32

trusted_proxy_depth: how many proxies to expect in the X-Forwarded-For chain (at least 1).

§trust_x_forwarded_proto: bool

trust_x_forwarded_proto.

§passive_mode: bool

passive_mode: log-only, nothing blocks.

§geo_ip_handler: Option<Arc<dyn GeoIpHandler>>

geo_ip_handler.

§enable_redis: bool

enable_redis.

§redis_url: Option<String>

redis_url.

§redis_prefix: String

redis_prefix.

§redis_socket_connect_timeout: Option<f64>

redis_socket_connect_timeout (seconds; Some must be positive).

§redis_socket_timeout: Option<f64>

redis_socket_timeout (seconds; Some must be positive).

§redis_health_check_interval: u64

redis_health_check_interval (seconds; 0 disables).

§redis_max_connections: Option<u64>

redis_max_connections (Some must be at least 1).

§redis_retries: u32

redis_retries (the type carries the at-least-0 bound).

§whitelist: Option<Vec<String>>

whitelist: restrictive when non-empty (IPs or CIDR ranges).

§blacklist: Vec<String>

blacklist.

§exempt_ips: Vec<String>

exempt_ips.

§whitelist_countries: BTreeSet<String>

whitelist_countries.

§blocked_countries: BTreeSet<String>

blocked_countries.

§blocked_user_agents: Vec<String>

blocked_user_agents.

§auto_ban_threshold: u32

auto_ban_threshold (at least 1).

§auto_ban_duration: u64

auto_ban_duration (seconds, at least 1).

§threat_ban_config: BTreeMap<String, ThreatBanEntry>

threat_ban_config: per-category threshold/duration overrides.

§enable_rate_limit_auto_ban: bool

enable_rate_limit_auto_ban.

§global_behavior_rules: Vec<BehaviorRule>

global_behavior_rules.

§behavior_scan_response_body: bool

behavior_scan_response_body.

§behavior_max_response_body_inspect_bytes: usize

behavior_max_response_body_inspect_bytes (1024..=10485760).

§body_read_timeout: f64

body_read_timeout (seconds, 0 < t <= 30).

§sync_body_read_max_concurrent: usize

sync_body_read_max_concurrent (1..=10000).

§custom_log_file: Option<String>

custom_log_file.

§log_suspicious_level: Option<LogLevel>

log_suspicious_level.

§log_request_level: Option<LogLevel>

log_request_level.

§log_country_check_level: Option<LogLevel>

log_country_check_level.

§log_format: LogFormat

log_format.

§custom_error_responses: BTreeMap<u16, String>

custom_error_responses: status code to body override.

§rate_limit: u32

rate_limit (the default-window request count).

§rate_limit_window: u64

rate_limit_window (seconds).

§enforce_https: bool

enforce_https.

§security_headers: SecurityHeadersConfig

security_headers.

§custom_request_check: Option<CustomRequestFn>

custom_request_check.

§auth_verifier: Option<AuthVerifier>

auth_verifier.

§custom_response_modifier: Option<ResponseModifierFn>

custom_response_modifier.

§on_block: Option<OnBlockHook>

on_block.

§on_error: Option<OnErrorFn>

on_error.

§enable_cors: bool

enable_cors.

§cors_allow_origins: Vec<String>

cors_allow_origins.

§cors_allow_methods: Vec<String>

cors_allow_methods.

§cors_allow_headers: Vec<String>

cors_allow_headers.

§cors_allow_credentials: bool

cors_allow_credentials.

§cors_expose_headers: Vec<String>

cors_expose_headers.

§cors_max_age: u64

cors_max_age (seconds).

§block_cloud_providers: Option<BTreeSet<String>>

block_cloud_providers.

§cloud_ip_refresh_interval: u64

cloud_ip_refresh_interval (seconds, 60..=86400).

§lazy_init: bool

lazy_init.

§geo_ip_db_max_age: u64

geo_ip_db_max_age (seconds, 3600..=604800).

§cloud_ip_store: Option<Arc<dyn CloudRangeStore>>

cloud_ip_store.

§exclude_paths: Vec<String>

exclude_paths (the framework’s own docs/static paths).

§enable_ip_banning: bool

enable_ip_banning.

§enable_rate_limiting: bool

enable_rate_limiting.

§enable_penetration_detection: bool

enable_penetration_detection.

§fail_secure: bool

fail_secure.

§redis_fail_open: bool

redis_fail_open.

§route_resolution_strict: bool

route_resolution_strict.

§ipinfo_token: Option<String>

ipinfo_token.

§ipinfo_db_path: Option<PathBuf>

ipinfo_db_path.

§enable_agent: bool

enable_agent.

§agent_api_key: Option<String>

agent_api_key (required when enable_agent).

§agent_strict: bool

agent_strict.

§agent_endpoint: String

agent_endpoint.

§agent_project_id: Option<String>

agent_project_id.

§agent_buffer_size: usize

agent_buffer_size.

§agent_flush_interval: u64

agent_flush_interval (seconds).

§agent_enable_events: bool

agent_enable_events.

§agent_enable_metrics: bool

agent_enable_metrics.

§agent_timeout: u64

agent_timeout (seconds).

§agent_retry_attempts: u32

agent_retry_attempts.

§agent_project_encryption_key: Option<String>

agent_project_encryption_key.

§agent_guard_version: Option<String>

agent_guard_version.

§agent_high_watermark_ratio: Option<f64>

agent_high_watermark_ratio (Some must be in (0, 1]).

§agent_max_concurrent_flushes: Option<u64>

agent_max_concurrent_flushes (Some must be at least 1).

§agent_buffer_overflow_policy: Option<BufferOverflowPolicy>

agent_buffer_overflow_policy.

§agent_backoff_factor: Option<f64>

agent_backoff_factor (Some must be positive).

§agent_sensitive_headers: Option<Vec<String>>

agent_sensitive_headers.

§agent_max_payload_size: Option<u64>

agent_max_payload_size.

§agent_compression_enabled: Option<bool>

agent_compression_enabled.

§agent_compression_threshold: Option<u64>

agent_compression_threshold.

§agent_install_id: Option<String>

agent_install_id.

§agent_payload_signing_secret: Option<String>

agent_payload_signing_secret.

§enable_dynamic_rules: bool

enable_dynamic_rules (requires enable_agent). Lets the SaaS dashboard change protection at runtime without a code change: a rule bans the IPs in its ip_blacklist (for ip_ban_duration seconds), unbans the IPs in its ip_whitelist, adds its suspicious_patterns to detection, and replaces blocked_countries, whitelist_countries, rate_limit, rate_limit_window, endpoint_rate_limits, block_cloud_providers, blocked_user_agents, enable_penetration_detection, enable_ip_banning, enable_rate_limiting, enable_rate_limit_auto_ban, auto_ban_threshold, auto_ban_duration, emergency_mode and emergency_whitelist. A rule cannot change any other setting.

§dynamic_rule_interval: u64

dynamic_rule_interval (seconds, at least 60).

§dynamic_rules_cache_path: Option<PathBuf>

dynamic_rules_cache_path.

§agent_status_interval: u64

agent_status_interval (seconds, 60..=86400).

§emergency_mode: bool

emergency_mode.

§emergency_whitelist: Vec<String>

emergency_whitelist.

§endpoint_rate_limits: BTreeMap<String, (u32, u64)>

endpoint_rate_limits: path pattern to (count, window seconds).

§detection_compiler_timeout: f64

detection_compiler_timeout (seconds, 0.1..=10.0).

§detection_max_scan_seconds: f64

detection_max_scan_seconds (seconds, 0.1..=60.0): the per-request cap on the summed regex scan CPU time, not wall time. Once spent the remaining patterns and values are skipped and a weighted pattern_timeout threat blocks the request. See crate::scan_budget.

§detection_pattern_validation_cache_path: Option<String>

detection_pattern_validation_cache_path.

§detection_max_content_length: usize

detection_max_content_length (1000..=100000).

§detection_max_body_inspect_bytes: usize

detection_max_body_inspect_bytes (1024..=10485760).

§detection_max_scan_values: usize

detection_max_scan_values (2..=100000).

§detection_max_scan_chars: usize

detection_max_scan_chars (1024..=262144).

§detection_max_json_depth: usize

detection_max_json_depth (1..=1000).

§detection_binary_min_run_length: usize

detection_binary_min_run_length (4..=1024).

§detection_preserve_attack_patterns: bool

detection_preserve_attack_patterns.

§detection_semantic_threshold: f64

detection_semantic_threshold (0.0..=1.0).

§detection_anomaly_threshold: f64

detection_anomaly_threshold (1.0..=10.0).

§detection_slow_pattern_threshold: f64

detection_slow_pattern_threshold (0.01..=1.0).

§detection_monitor_history_size: usize

detection_monitor_history_size (100..=10000).

§detection_max_tracked_patterns: usize

detection_max_tracked_patterns (100..=5000).

§detection_anomaly_emission_cooldown: f64

detection_anomaly_emission_cooldown (seconds, 1.0..=3600.0).

§detection_min_samples_for_anomaly: usize

detection_min_samples_for_anomaly (10..=1000).

§detection_threat_score_threshold: f64

detection_threat_score_threshold (0.0..=10.0).

§muted_event_types: BTreeSet<String>

muted_event_types.

§muted_metric_types: BTreeSet<String>

muted_metric_types.

§muted_check_logs: BTreeSet<String>

muted_check_logs.

§log_sensitive_headers: BTreeSet<String>

log_sensitive_headers.

§log_sensitive_params: BTreeSet<String>

log_sensitive_params.

§log_sensitive_body_fields: BTreeSet<String>

log_sensitive_body_fields.

§enable_otel: bool

enable_otel.

§otel_service_name: String

otel_service_name.

§otel_exporter_endpoint: Option<String>

otel_exporter_endpoint.

§otel_resource_attributes: BTreeMap<String, String>

otel_resource_attributes.

§enable_logfire: bool

enable_logfire.

§logfire_service_name: String

logfire_service_name.

§enable_enrichment: bool

enable_enrichment (requires enable_agent).

§excluded_detection_headers: BTreeSet<String>

excluded_detection_headers.

§excluded_semantic_detection_headers: BTreeSet<String>

excluded_semantic_detection_headers (opt-in, default empty): header names whose values skip the semantic analyzer only, matched case-insensitively; regex category scanning is unchanged. Useful for apps whose JWT session cookies score near the semantic threshold (for example cookie, authorization).

§excluded_detection_params: BTreeSet<String>

excluded_detection_params.

§excluded_detection_body_fields: BTreeSet<String>

excluded_detection_body_fields.

§detection_scan_body: bool

detection_scan_body.

§enabled_detection_categories: BTreeSet<String>

enabled_detection_categories (defaults to ALL_DETECTION_CATEGORIES).

Implementations§

Source §

impl SecurityConfig

Source

pub fn new() -> Self

The reference-default configuration. Validation still runs before use; the defaults satisfy every constraint.

Source

pub fn validate(&self) -> Result<(), SecurityConfigError>

Validate every reference constraint, collecting all violations.

The length is the reference constraint list, one check per pydantic gt/ge/le bound plus the list parsers and the cross-field agent rules; every violation is collected, none short-circuits.