Struct ContentSecurityPolicy 

pub struct ContentSecurityPolicy { /* private fields */ }

Content-Security-Policy response header.

Adding a directive that already exists in the policy replaces its source-list in place (preserving declared order). The user agent would ignore a second occurrence anyway, so we keep the value the caller most recently supplied.

Examples

use rama_http_headers::{ContentSecurityPolicy, HostSource, SourceList};

let csp = ContentSecurityPolicy::strict_self().with_img_src(
    SourceList::self_origin()
        .with_data()
        .with_host(HostSource::try_parse("https://raw.githubusercontent.com").unwrap()),
);

let rendered = csp.to_string();
assert!(rendered.contains("img-src 'self' data: https://raw.githubusercontent.com"));
assert!(rendered.contains("frame-ancestors 'none'"));

Implementations

impl ContentSecurityPolicy

pub const fn empty() -> Self

Empty policy. Build from this when you want to add directives one at a time rather than starting from a baseline.

pub fn strict_self() -> Self

Strict same-origin baseline:

default-src 'self'; script-src 'self'; style-src 'self';
img-src 'self'; font-src 'self'; connect-src 'self';
form-action 'self'; base-uri 'self'; frame-ancestors 'none'

pub fn directives(&self) -> impl Iterator<Item = &Directive> + '_

Iterate the policy’s directives in encoding order.

pub fn with(self, name: impl Into<DirectiveName>, sources: SourceList) -> Self

Generic escape hatch: append or replace any directive by name. If the directive already exists, its source-list is overwritten in place (order preserved); otherwise it’s appended.

pub fn set( &mut self, name: impl Into<DirectiveName>, sources: SourceList, ) -> &mut Self

In-place sibling of with.

pub fn with_default_src(self, sources: SourceList) -> Self

Set default-src.

pub fn set_default_src(&mut self, sources: SourceList) -> &mut Self

Set default-src.

pub fn with_script_src(self, sources: SourceList) -> Self

Set script-src.

pub fn set_script_src(&mut self, sources: SourceList) -> &mut Self

Set script-src.

pub fn with_style_src(self, sources: SourceList) -> Self

Set style-src.

pub fn set_style_src(&mut self, sources: SourceList) -> &mut Self

Set style-src.

pub fn with_img_src(self, sources: SourceList) -> Self

Set img-src.

pub fn set_img_src(&mut self, sources: SourceList) -> &mut Self

Set img-src.

pub fn with_font_src(self, sources: SourceList) -> Self

Set font-src.

pub fn set_font_src(&mut self, sources: SourceList) -> &mut Self

Set font-src.

pub fn with_connect_src(self, sources: SourceList) -> Self

Set connect-src.

pub fn set_connect_src(&mut self, sources: SourceList) -> &mut Self

Set connect-src.

pub fn with_media_src(self, sources: SourceList) -> Self

Set media-src.

pub fn set_media_src(&mut self, sources: SourceList) -> &mut Self

Set media-src.

pub fn with_object_src(self, sources: SourceList) -> Self

Set object-src.

pub fn set_object_src(&mut self, sources: SourceList) -> &mut Self

Set object-src.

pub fn with_frame_src(self, sources: SourceList) -> Self

Set frame-src.

pub fn set_frame_src(&mut self, sources: SourceList) -> &mut Self

Set frame-src.

pub fn with_frame_ancestors(self, sources: SourceList) -> Self

Set frame-ancestors. Note that nonces, hashes, and 'unsafe-inline' are not valid sources here per CSP3 § 6.1.2 (we don’t enforce that — just be aware).

pub fn set_frame_ancestors(&mut self, sources: SourceList) -> &mut Self

Set frame-ancestors. Note that nonces, hashes, and 'unsafe-inline' are not valid sources here per CSP3 § 6.1.2 (we don’t enforce that — just be aware).

pub fn with_child_src(self, sources: SourceList) -> Self

Set child-src.

pub fn set_child_src(&mut self, sources: SourceList) -> &mut Self

Set child-src.

pub fn with_worker_src(self, sources: SourceList) -> Self

Set worker-src.

pub fn set_worker_src(&mut self, sources: SourceList) -> &mut Self

Set worker-src.

pub fn with_manifest_src(self, sources: SourceList) -> Self

Set manifest-src.

pub fn set_manifest_src(&mut self, sources: SourceList) -> &mut Self

Set manifest-src.

pub fn with_form_action(self, sources: SourceList) -> Self

Set form-action.

pub fn set_form_action(&mut self, sources: SourceList) -> &mut Self

Set form-action.

pub fn with_base_uri(self, sources: SourceList) -> Self

Set base-uri.

pub fn set_base_uri(&mut self, sources: SourceList) -> &mut Self

Set base-uri.

pub fn with_navigate_to(self, sources: SourceList) -> Self

Set navigate-to.

pub fn set_navigate_to(&mut self, sources: SourceList) -> &mut Self

Set navigate-to.

pub fn with_report_to(self, sources: SourceList) -> Self

Set report-to.

pub fn set_report_to(&mut self, sources: SourceList) -> &mut Self

Set report-to.

pub fn with_upgrade_insecure_requests(self) -> Self

Set the valueless upgrade-insecure-requests directive.

pub fn set_upgrade_insecure_requests(&mut self) -> &mut Self

Set the valueless upgrade-insecure-requests directive.

Trait Implementations

impl Clone for ContentSecurityPolicy

fn clone(&self) -> ContentSecurityPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ContentSecurityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ContentSecurityPolicy

fn default() -> ContentSecurityPolicy

Returns the “default value” for a type.

impl Display for ContentSecurityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ContentSecurityPolicy

impl HeaderDecode for ContentSecurityPolicy

fn decode<'i, I: Iterator<Item = &'i HeaderValue>>( values: &mut I, ) -> Result<Self, Error>

Decode this type from an iterator of HeaderValues.

impl HeaderEncode for ContentSecurityPolicy

fn encode<E: Extend<HeaderValue>>(&self, values: &mut E)

Encode this type to a HeaderValue, and add it to a container which has HeaderValue type as each element.

fn encode_to_value(&self) -> Option<HeaderValue>

Encode this header to HeaderValue.

impl PartialEq for ContentSecurityPolicy

fn eq(&self, other: &ContentSecurityPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for ContentSecurityPolicy

impl TypedHeader for ContentSecurityPolicy

fn name() -> &'static HeaderName

The name of this header.