Crate ntex_helmet

source ·
Expand description

`ntex-helmet`` is a collection of HTTP headers that help secure your ntex app by setting various HTTP headers.

`ntex_helmet::Helmet`` is a middleware that automatically sets these headers.

It is based on the Helmet library for Node.js and is highly configurable.

Usage

use ntex::web;
use ntex_helmet::Helmet;

#[ntex::main]
async fn main() -> std::io::Result<()> {
    web::HttpServer::new(move || {
        web::App::new()
           .wrap(Helmet::default())
           .service(web::resource("/").to(|| async { "Hello, world!" }))
    })
    .bind(("127.0.0.1", 8080))?
    .run()
    .await
}

By default Helmet will set the following headers:

Content-Security-Policy: default-src 'self'; base-uri 'self'; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: no-referrer
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: sameorigin
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 0

This might be a good starting point for most users, but it is highly recommended to spend some time with the documentation for each header, and adjust them to your needs.

Configuration

By default if you construct a new instance of Helmet it will not set any headers.

It is possible to configure Helmet to set only the headers you want, by using the add method to add headers.

use ntex::web;
use ntex_helmet::{ContentSecurityPolicy, CrossOriginOpenerPolicy, Helmet};

#[ntex::main]
async fn main() -> std::io::Result<()> {
    web::HttpServer::new(move || {
        web::App::new()
            .wrap(
                Helmet::new()
                    .add(
                        ContentSecurityPolicy::new()
                            .child_src(vec!["'self'", "https://youtube.com"])
                            .connect_src(vec!["'self'", "https://youtube.com"])
                            .default_src(vec!["'self'", "https://youtube.com"])
                            .font_src(vec!["'self'", "https://youtube.com"]),
                    )
                    .add(CrossOriginOpenerPolicy::same_origin_allow_popups()),
            )
            .service(web::resource("/").to(|| async { "Hello, world!" }))
    })
    .bind(("127.0.0.1", 4200))?
    .run()
    .await
}

Structs

Enums

Traits