Struct SecurityMiddleware 

#[non_exhaustive]
pub struct SecurityMiddleware {
    pub hsts_enabled: bool,
    pub hsts_seconds: u32,
    pub hsts_include_subdomains: bool,
    pub hsts_preload: bool,
    pub ssl_redirect: bool,
    pub content_type_nosniff: bool,
    pub referrer_policy: Option<String>,
    pub cross_origin_opener_policy: Option<String>,
    pub x_frame_options: Option<String>,
    pub secure_proxy_ssl_header: Option<(String, String)>,
}

Available on crate feature middleware-security only.

Security middleware for HTTP security headers and redirects

Construction

Use SecurityMiddleware::new for sensible defaults, or SecurityMiddleware::from_security_settings to build from a SecuritySettings fragment loaded via reinhardt-conf.

Individual fields can be customized via with_* builder methods:

use reinhardt_middleware::SecurityMiddleware;

let middleware = SecurityMiddleware::new()
    .with_hsts_include_subdomains(true)
    .with_hsts_preload(true)
    .with_referrer_policy("strict-origin-when-cross-origin");

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

hsts_enabled: bool

Enable HSTS (HTTP Strict Transport Security)

hsts_seconds: u32

HSTS max-age in seconds (default: 31536000 = 1 year)

hsts_include_subdomains: bool

Include subdomains in HSTS

hsts_preload: bool

Include preload directive in HSTS

ssl_redirect: bool

Redirect HTTP to HTTPS

content_type_nosniff: bool

Set X-Content-Type-Options: nosniff

referrer_policy: Option<String>

Referrer-Policy value

cross_origin_opener_policy: Option<String>

Cross-Origin-Opener-Policy value

x_frame_options: Option<String>

X-Frame-Options value (e.g., “DENY”, “SAMEORIGIN”)

secure_proxy_ssl_header: Option<(String, String)>

Proxy SSL header name and expected value for identifying secure requests

Implementations

impl SecurityMiddleware

pub fn new() -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Create a new SecurityMiddleware with default configuration

Examples

use std::sync::Arc;
use reinhardt_middleware::SecurityMiddleware;
use reinhardt_http::{Handler, Middleware, Request, Response};
use hyper::{StatusCode, Method, Version, HeaderMap};
use bytes::Bytes;

struct TestHandler;

#[async_trait::async_trait]
impl Handler for TestHandler {
    async fn handle(&self, _request: Request) -> reinhardt_core::exception::Result<Response> {
        Ok(Response::new(StatusCode::OK))
    }
}

let middleware = SecurityMiddleware::new();
let handler = Arc::new(TestHandler);

let request = Request::builder()
    .method(Method::GET)
    .uri("/api/data")
    .version(Version::HTTP_11)
    .headers(HeaderMap::new())
    .secure(true)
    .body(Bytes::new())
    .build()
    .unwrap();

let response = middleware.process(request, handler).await.unwrap();
assert!(response.headers.contains_key("Strict-Transport-Security"));
assert_eq!(response.headers.get("X-Content-Type-Options").unwrap(), "nosniff");

pub fn from_security_settings(settings: &SecuritySettings) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Create a new SecurityMiddleware from a SecuritySettings fragment

Maps security-related fields from SecuritySettings to the middleware configuration. Middleware-specific defaults (e.g., content_type_nosniff, referrer_policy) are preserved from SecurityMiddleware::default.

Examples

use reinhardt_conf::SecuritySettings;
use reinhardt_middleware::SecurityMiddleware;

let settings = SecuritySettings {
    secure_ssl_redirect: true,
    secure_hsts_seconds: Some(31536000),
    ..Default::default()
};

let middleware = SecurityMiddleware::from_security_settings(&settings);

pub fn with_hsts(self, enabled: bool) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Set whether HSTS is enabled

pub fn with_hsts_seconds(self, seconds: u32) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Set the HSTS max-age in seconds

pub fn with_hsts_include_subdomains(self, include: bool) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Set whether to include subdomains in HSTS

pub fn with_hsts_preload(self, preload: bool) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Set whether to include preload directive in HSTS

pub fn with_ssl_redirect(self, redirect: bool) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Set whether to redirect HTTP to HTTPS

pub fn with_content_type_nosniff(self, nosniff: bool) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Set whether to add X-Content-Type-Options: nosniff

pub fn with_referrer_policy( self, policy: impl Into<String>, ) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Set the Referrer-Policy header value

pub fn without_referrer_policy(self) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Remove the Referrer-Policy header

pub fn with_cross_origin_opener_policy( self, policy: impl Into<String>, ) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Set the Cross-Origin-Opener-Policy header value

pub fn without_cross_origin_opener_policy(self) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Remove the Cross-Origin-Opener-Policy header

pub fn with_x_frame_options( self, value: impl Into<String>, ) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Set the X-Frame-Options header value

pub fn without_x_frame_options(self) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Remove the X-Frame-Options header

pub fn with_secure_proxy_ssl_header( self, header: impl Into<String>, value: impl Into<String>, ) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Set the proxy SSL header name and expected value

pub fn without_secure_proxy_ssl_header(self) -> SecurityMiddleware

Available on native and crate feature security and (crate features middleware or standard) only.

Remove the proxy SSL header configuration

Trait Implementations

impl Clone for SecurityMiddleware

fn clone(&self) -> SecurityMiddleware

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityMiddleware

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for SecurityMiddleware

fn default() -> SecurityMiddleware

Returns the “default value” for a type.

impl Middleware for SecurityMiddleware

fn process<'life0, 'async_trait>( &'life0 self, request: Request, handler: Arc<dyn Handler>, ) -> Pin<Box<dyn Future<Output = Result<Response, Error>> + Send + 'async_trait>>

where 'life0: 'async_trait, SecurityMiddleware: 'async_trait,

Processes a request through this middleware.

fn should_continue(&self, _request: &Request) -> bool

Determines whether this middleware should be executed for the given request.

fn di_registrations(&self) -> Vec<(TypeId, Arc<dyn Any + Send + Sync>)>

Returns DI singleton registrations contributed by this middleware.