http_security_headers/
lib.rs

1//! # http-security-headers
2//!
3//! Type-safe, framework-agnostic HTTP security headers with Tower middleware support.
4//!
5//! ## Features
6//!
7//! - **Type-safe configuration**: Compile-time guarantees for header values
8//! - **Builder pattern**: Ergonomic, fluent API
9//! - **Preset configurations**: Strict, Balanced, and Relaxed security levels
10//! - **Tower middleware**: Framework-agnostic (works with Axum, Actix, Tonic, etc.)
11//! - **Zero dependencies**: Core library has minimal dependencies (only `thiserror`)
12//!
13//! ## Quick Start
14//!
15//! ```rust
16//! use http_security_headers::{SecurityHeaders, Preset};
17//! use std::time::Duration;
18//!
19//! // Use a preset configuration
20//! let headers = Preset::Strict.build();
21//!
22//! // Or build a custom configuration
23//! let headers = SecurityHeaders::builder()
24//!     .strict_transport_security(Duration::from_secs(31536000), true, false)
25//!     .x_frame_options_deny()
26//!     .referrer_policy_no_referrer()
27//!     .build()
28//!     .unwrap();
29//! ```
30//!
31//! ## Using with Axum
32//!
33//! Enable the `middleware` feature in your `Cargo.toml`:
34//!
35//! ```toml
36//! [dependencies]
37//! http-security-headers = { version = "0.1", features = ["middleware"] }
38//! ```
39//!
40//! Then use the middleware layer:
41//!
42//! ```rust,ignore
43//! use axum::{Router, routing::get};
44//! use http_security_headers::{Preset, SecurityHeadersLayer};
45//! use std::sync::Arc;
46//!
47//! let headers = Arc::new(Preset::Strict.build());
48//!
49//! let app = Router::new()
50//!     .route("/", get(|| async { "Hello, World!" }))
51//!     .layer(SecurityHeadersLayer::new(headers));
52//! ```
53//!
54//! ## Security Headers Supported
55//!
56//! - **Content-Security-Policy (CSP)**: Prevents XSS and code injection attacks
57//! - **Strict-Transport-Security (HSTS)**: Forces HTTPS connections
58//! - **X-Frame-Options**: Prevents clickjacking attacks
59//! - **X-Content-Type-Options**: Prevents MIME type sniffing
60//! - **Referrer-Policy**: Controls referrer information
61//! - **Cross-Origin-Opener-Policy (COOP)**: Isolates browsing contexts
62//! - **Cross-Origin-Embedder-Policy (COEP)**: Controls cross-origin resource loading
63//! - **Cross-Origin-Resource-Policy (CORP)**: Controls resource sharing
64
65#![warn(missing_docs, rust_2021_compatibility)]
66#![deny(unsafe_code)]
67
68mod config;
69mod error;
70pub mod policy;
71pub mod preset;
72
73#[cfg(feature = "middleware")]
74pub mod middleware;
75
76#[cfg(feature = "actix")]
77pub mod actix;
78
79pub use config::{SecurityHeaders, SecurityHeadersBuilder};
80pub use error::{Error, Result};
81pub use policy::{
82    ContentSecurityPolicy, CrossOriginEmbedderPolicy, CrossOriginOpenerPolicy,
83    CrossOriginResourcePolicy, ReferrerPolicy, StrictTransportSecurity, XFrameOptions,
84};
85pub use preset::Preset;
86
87#[cfg(feature = "middleware")]
88pub use middleware::{add_security_headers, SecurityHeadersLayer};
89
90#[cfg(feature = "actix")]
91pub use actix::SecurityHeadersMiddleware;
http_security_headers/lib.rs

http_security_headers/
lib.rs
