Struct ContentSecurityPolicy 

pub struct ContentSecurityPolicy { /* private fields */ }

Content-Security-Policy configuration.

Examples

use http_security_headers::ContentSecurityPolicy;

let csp = ContentSecurityPolicy::new()
    .default_src(vec!["'self'"])
    .script_src(vec!["'self'", "'unsafe-inline'"])
    .style_src(vec!["'self'", "https://fonts.googleapis.com"])
    .img_src(vec!["'self'", "data:", "https:"]);

Implementations

impl ContentSecurityPolicy

pub fn new() -> Self

Creates a new empty CSP policy.

pub fn default_src<I, S>(self, sources: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets the default-src directive.

This serves as a fallback for other fetch directives.

pub fn script_src<I, S>(self, sources: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets the script-src directive.

Specifies valid sources for JavaScript.

pub fn style_src<I, S>(self, sources: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets the style-src directive.

Specifies valid sources for stylesheets.

pub fn img_src<I, S>(self, sources: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets the img-src directive.

Specifies valid sources for images.

pub fn font_src<I, S>(self, sources: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets the font-src directive.

Specifies valid sources for fonts.

pub fn connect_src<I, S>(self, sources: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets the connect-src directive.

Restricts URLs that can be loaded using script interfaces (fetch, XHR, WebSocket, etc.).

pub fn object_src<I, S>(self, sources: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets the object-src directive.

Specifies valid sources for <object>, <embed>, and <applet> elements.

pub fn frame_src<I, S>(self, sources: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets the frame-src directive.

Specifies valid sources for nested browsing contexts loaded using <frame> and <iframe>.

pub fn base_uri<I, S>(self, sources: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets the base-uri directive.

Restricts the URLs that can be used in a document’s <base> element.

pub fn form_action<I, S>(self, sources: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets the form-action directive.

Restricts the URLs which can be used as the target of form submissions.

pub fn frame_ancestors<I, S>(self, sources: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets the frame-ancestors directive.

Specifies valid parents that may embed a page using <frame>, <iframe>, etc.

pub fn upgrade_insecure_requests(self) -> Self

Sets the upgrade-insecure-requests directive (valueless).

Instructs browsers to upgrade all insecure requests to HTTPS.

pub fn block_all_mixed_content(self) -> Self

Sets the block-all-mixed-content directive (valueless).

Prevents loading any mixed content (HTTP resources on HTTPS pages).

pub fn directive<I, S>(self, name: &str, sources: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets a custom directive.

This allows setting directives not covered by the convenience methods.

pub fn to_header_value(&self) -> Result<String>

Converts the policy to its header value string.

pub fn parse(value: &str) -> Result<Self>

Parses a CSP policy from a header value string.

Examples

use http_security_headers::ContentSecurityPolicy;

let csp = ContentSecurityPolicy::parse("default-src 'self'; script-src 'unsafe-inline'").unwrap();

Trait Implementations

impl Clone for ContentSecurityPolicy

fn clone(&self) -> ContentSecurityPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ContentSecurityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ContentSecurityPolicy

fn default() -> Self

Returns the “default value” for a type.

impl Display for ContentSecurityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for ContentSecurityPolicy

fn eq(&self, other: &ContentSecurityPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for ContentSecurityPolicy

impl StructuralPartialEq for ContentSecurityPolicy