Struct CspMiddleware 

pub struct CspMiddleware { /* private fields */ }

Available on (crate features standard or middleware) and native only.

Content Security Policy middleware

Implementations

impl CspMiddleware

pub fn new() -> CspMiddleware

Create a new CspMiddleware with default configuration

Default configuration includes default-src 'self' directive.

Examples

use std::sync::Arc;
use reinhardt_middleware::CspMiddleware;
use reinhardt_http::{Handler, Middleware, Request, Response};
use hyper::{StatusCode, Method, Version, HeaderMap};
use bytes::Bytes;

struct TestHandler;

#[async_trait::async_trait]
impl Handler for TestHandler {
    async fn handle(&self, _request: Request) -> reinhardt_core::exception::Result<Response> {
        Ok(Response::new(StatusCode::OK))
    }
}

let middleware = CspMiddleware::new();
let handler = Arc::new(TestHandler);

let request = Request::builder()
    .method(Method::GET)
    .uri("/page")
    .version(Version::HTTP_11)
    .headers(HeaderMap::new())
    .body(Bytes::new())
    .build()
    .unwrap();

let response = middleware.process(request, handler).await.unwrap();
let csp = response.headers.get("Content-Security-Policy").unwrap();
assert!(csp.to_str().unwrap().contains("default-src 'self'"));

pub fn with_config(config: CspConfig) -> CspMiddleware

Create a new CspMiddleware with custom configuration

Arguments

• config - Custom CSP configuration

Examples

use std::sync::Arc;
use reinhardt_middleware::{CspMiddleware, CspConfig};
use reinhardt_http::{Handler, Middleware, Request, Response};
use hyper::{StatusCode, Method, Version, HeaderMap};
use bytes::Bytes;
use std::collections::HashMap;

struct TestHandler;

#[async_trait::async_trait]
impl Handler for TestHandler {
    async fn handle(&self, _request: Request) -> reinhardt_core::exception::Result<Response> {
        Ok(Response::new(StatusCode::OK))
    }
}

let mut directives = HashMap::new();
directives.insert("default-src".to_string(), vec!["'self'".to_string()]);
directives.insert("script-src".to_string(), vec!["'self'".to_string(), "https://cdn.example.com".to_string()]);

let mut config = CspConfig::default();
config.directives = directives;
config.report_only = false;
config.include_nonce = false;

let middleware = CspMiddleware::with_config(config);
let handler = Arc::new(TestHandler);

let request = Request::builder()
    .method(Method::GET)
    .uri("/app")
    .version(Version::HTTP_11)
    .headers(HeaderMap::new())
    .body(Bytes::new())
    .build()
    .unwrap();

let response = middleware.process(request, handler).await.unwrap();
let csp = response.headers.get("Content-Security-Policy").unwrap().to_str().unwrap();
assert!(csp.contains("script-src 'self' https://cdn.example.com"));

pub fn strict() -> CspMiddleware

Create a strict CSP middleware

Uses a restrictive configuration with strong security defaults.

Examples

use std::sync::Arc;
use reinhardt_middleware::CspMiddleware;
use reinhardt_http::{Handler, Middleware, Request, Response};
use hyper::{StatusCode, Method, Version, HeaderMap};
use bytes::Bytes;

struct TestHandler;

#[async_trait::async_trait]
impl Handler for TestHandler {
    async fn handle(&self, _request: Request) -> reinhardt_core::exception::Result<Response> {
        Ok(Response::new(StatusCode::OK))
    }
}

let middleware = CspMiddleware::strict();
let handler = Arc::new(TestHandler);

let request = Request::builder()
    .method(Method::GET)
    .uri("/secure-app")
    .version(Version::HTTP_11)
    .headers(HeaderMap::new())
    .body(Bytes::new())
    .build()
    .unwrap();

let response = middleware.process(request, handler).await.unwrap();
let csp = response.headers.get("Content-Security-Policy").unwrap().to_str().unwrap();
assert!(csp.contains("default-src 'self'"));
assert!(csp.contains("script-src 'self'"));
assert!(csp.contains("frame-ancestors 'none'"));
assert!(csp.contains("base-uri 'self'"));

Trait Implementations

impl Default for CspMiddleware

fn default() -> CspMiddleware

Returns the “default value” for a type.

impl Middleware for CspMiddleware

fn process<'life0, 'async_trait>( &'life0 self, request: Request, handler: Arc<dyn Handler>, ) -> Pin<Box<dyn Future<Output = Result<Response, Error>> + Send + 'async_trait>>

where 'life0: 'async_trait, CspMiddleware: 'async_trait,

Processes a request through this middleware.

fn should_continue(&self, _request: &Request) -> bool

Determines whether this middleware should be executed for the given request.