http_security_headers/policy/
frame_options.rs

1//! X-Frame-Options header configuration.
2//!
3//! The X-Frame-Options header protects against clickjacking attacks by controlling
4//! whether a browser should be allowed to render a page in a `<frame>`, `<iframe>`,
5//! `<embed>`, or `<object>`.
6
7use crate::error::{Error, Result};
8
9/// X-Frame-Options header value.
10///
11/// # Examples
12///
13/// ```
14/// use http_security_headers::XFrameOptions;
15///
16/// let deny = XFrameOptions::Deny;
17/// let sameorigin = XFrameOptions::SameOrigin;
18/// ```
19#[derive(Debug, Clone, Copy, PartialEq, Eq)]
20pub enum XFrameOptions {
21    /// The page cannot be displayed in a frame, regardless of the site attempting to do so.
22    Deny,
23    /// The page can only be displayed in a frame on the same origin as the page itself.
24    SameOrigin,
25}
26
27impl XFrameOptions {
28    /// Converts the policy to its header value string.
29    pub fn as_str(&self) -> &'static str {
30        match self {
31            Self::Deny => "DENY",
32            Self::SameOrigin => "SAMEORIGIN",
33        }
34    }
35}
36
37impl std::str::FromStr for XFrameOptions {
38    type Err = Error;
39
40    fn from_str(s: &str) -> Result<Self> {
41        match s.to_uppercase().as_str() {
42            "DENY" => Ok(Self::Deny),
43            "SAMEORIGIN" => Ok(Self::SameOrigin),
44            _ => Err(Error::InvalidFrameOptions(format!(
45                "Expected 'DENY' or 'SAMEORIGIN', got '{}'",
46                s
47            ))),
48        }
49    }
50}
51
52impl std::fmt::Display for XFrameOptions {
53    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
54        write!(f, "{}", self.as_str())
55    }
56}
57
58#[cfg(test)]
59mod tests {
60    use super::*;
61    use std::str::FromStr;
62
63    #[test]
64    fn test_as_str() {
65        assert_eq!(XFrameOptions::Deny.as_str(), "DENY");
66        assert_eq!(XFrameOptions::SameOrigin.as_str(), "SAMEORIGIN");
67    }
68
69    #[test]
70    fn test_from_str() {
71        assert_eq!(XFrameOptions::from_str("DENY").unwrap(), XFrameOptions::Deny);
72        assert_eq!(XFrameOptions::from_str("deny").unwrap(), XFrameOptions::Deny);
73        assert_eq!(
74            XFrameOptions::from_str("SAMEORIGIN").unwrap(),
75            XFrameOptions::SameOrigin
76        );
77        assert_eq!(
78            XFrameOptions::from_str("sameorigin").unwrap(),
79            XFrameOptions::SameOrigin
80        );
81
82        assert!(XFrameOptions::from_str("invalid").is_err());
83    }
84
85    #[test]
86    fn test_display() {
87        assert_eq!(XFrameOptions::Deny.to_string(), "DENY");
88        assert_eq!(XFrameOptions::SameOrigin.to_string(), "SAMEORIGIN");
89    }
90}
http_security_headers/policy/frame_options.rs

http_security_headers/policy/
frame_options.rs
