pub struct SecurityHeaders { /* private fields */ }Expand description
The three response headers the project’s security rules require on every response.
Held as a value rather than written at each call site because the rule is “every response”, and the way that rule gets broken is a fourth route added later that sets its own headers and forgets these. One value, attached by one router-level layer, has no per-route path to miss.
The defaults are the strictest spelling of each header rather than a
permissive one. default-src 'none' denies the response every fetch
directive it does not explicitly re-grant, and an MCP endpoint serves no
scripts, styles, frames or connections at all, so there is nothing to
re-grant. frame-ancestors 'none' is the modern form and is why X-Frame- Options is still sent alongside it: the older header is what a browser
predating CSP consults.
Implementations§
Source§impl SecurityHeaders
impl SecurityHeaders
Sourcepub fn with_content_security_policy(self, value: impl Into<Arc<str>>) -> Self
pub fn with_content_security_policy(self, value: impl Into<Arc<str>>) -> Self
Replaces the Content-Security-Policy value.
Sourcepub fn with_strict_transport_security(self, value: impl Into<Arc<str>>) -> Self
pub fn with_strict_transport_security(self, value: impl Into<Arc<str>>) -> Self
Replaces the Strict-Transport-Security value.
Sourcepub fn with_x_frame_options(self, value: impl Into<Arc<str>>) -> Self
pub fn with_x_frame_options(self, value: impl Into<Arc<str>>) -> Self
Replaces the X-Frame-Options value.
Sourcepub fn content_security_policy(&self) -> &str
pub fn content_security_policy(&self) -> &str
The Content-Security-Policy value.
Sourcepub fn strict_transport_security(&self) -> &str
pub fn strict_transport_security(&self) -> &str
The Strict-Transport-Security value.
Sourcepub fn x_frame_options(&self) -> &str
pub fn x_frame_options(&self) -> &str
The X-Frame-Options value.