Module security_headers 

Conservative security response headers.

When crate::startup::get_root_router_autoinject is used, every response gets a default set of security headers unless the operator opts out via the YAML config (security_headers: block).

Defaults:

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
Referrer-Policy	strict-origin-when-cross-origin

Content-Security-Policy, Permissions-Policy and Cross-Origin-Opener-Policy are off by default because they are highly application-specific.

Set a field to null in YAML to disable a specific header without turning the whole hoop off:

security_headers:
  hsts: null  # acceptable for `http_localhost` dev setups

Whatever the YAML says, HSTS is also skipped automatically when the server starts in http_localhost or unsafe_http mode — sending Strict-Transport-Security over plain HTTP would pin localhost in the developer’s browser for a year. Headers already present on the response are left untouched, so per-route overrides win.

Structs

SecurityHeaders

Salvo hoop that injects the configured security headers into every response. Build via SecurityHeaders::new and attach with router.hoop(...).

SecurityHeadersOptions

YAML-configurable values for the security headers hoop.