Struct InsecureOptions 

pub struct InsecureOptions {
    pub allow_open_security_filters: bool,
    pub allow_private_endpoints: bool,
    pub allow_private_health_checks: bool,
    pub allow_public_admin: bool,
    pub allow_root: bool,
    pub allow_tls_without_sni: bool,
    pub allow_unbounded_body: bool,
    pub csrf_log_only: bool,
    pub skip_pipeline_validation: bool,
}

Consolidated security overrides for Praxis.

Every field defaults to false. Setting a flag to true demotes the corresponding security check from an error to a warning.

Only intended for use in development and testing.

use praxis_core::config::InsecureOptions;

let opts = InsecureOptions::default();
assert!(!opts.allow_open_security_filters);
assert!(!opts.allow_private_endpoints);
assert!(!opts.allow_private_health_checks);
assert!(!opts.allow_public_admin);
assert!(!opts.allow_root);
assert!(!opts.allow_tls_without_sni);
assert!(!opts.allow_unbounded_body);
assert!(!opts.csrf_log_only);
assert!(!opts.skip_pipeline_validation);

use praxis_core::config::InsecureOptions;

let opts: InsecureOptions =
    serde_yaml::from_str("allow_root: true\nallow_public_admin: true\n").unwrap();
assert!(opts.allow_root);
assert!(opts.allow_public_admin);
assert!(!opts.allow_unbounded_body);

Fields

allow_open_security_filters: bool

Allow security-critical filters to use failure_mode: open, demoting the validation error to a warning.

allow_private_endpoints: bool

Allow cluster endpoints to resolve to loopback, link-local, or cloud metadata addresses.

allow_private_health_checks: bool

Allow health checks to loopback/metadata addresses.

allow_public_admin: bool

Allow admin endpoint on 0.0.0.0 / [::].

allow_root: bool

Allow running as root (UID 0).

allow_tls_without_sni: bool

Allow TLS without SNI hostname verification.

allow_unbounded_body: bool

Allow startup without body_limits.max_request_bytes or body_limits.max_response_bytes configured. Without this flag, missing body limits are a hard validation error.

csrf_log_only: bool

Run the CSRF filter in log-only mode: evaluate all rules but log violations as warnings instead of rejecting requests.

skip_pipeline_validation: bool

Skip pipeline ordering validation. This blanket-disables all structural safety checks including conditional security filters and failure_mode: open detection.

Trait Implementations

impl Clone for InsecureOptions

fn clone(&self) -> InsecureOptions

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for InsecureOptions

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for InsecureOptions

fn default() -> InsecureOptions

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for InsecureOptions

where InsecureOptions: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for InsecureOptions

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.