Struct OriginGuardMiddleware 

pub struct OriginGuardMiddleware { /* private fields */ }

Available on (crate features standard or middleware) and native only.

Middleware that validates the Origin or Referer header on state-changing requests as a CSRF protection layer.

Safe methods (GET, HEAD, OPTIONS) are always passed through. For state-changing methods (POST, PUT, DELETE, PATCH) the middleware checks whether the request origin appears in the allowed_origins list:

1. Reads the Origin header directly.
2. If absent, falls back to the Referer header and extracts the scheme://authority portion.
3. If the origin matches → request proceeds.
4. If neither header is present, or the origin does not match → 403 Forbidden with body "Origin validation failed".

Examples

use std::sync::Arc;
use reinhardt_middleware::OriginGuardMiddleware;
use reinhardt_http::MiddlewareChain;

let middleware = OriginGuardMiddleware::new(vec![
    "https://example.com".to_string(),
    "https://app.example.com".to_string(),
]);

let app = MiddlewareChain::new(handler)
    .with_middleware(Arc::new(middleware));

Implementations

impl OriginGuardMiddleware

pub fn new(allowed_origins: Vec<String>) -> OriginGuardMiddleware

Creates a new OriginGuardMiddleware with the given list of allowed origins.

Each entry should be a scheme://authority string such as "https://example.com" (no trailing slash, no path).

Arguments

• allowed_origins - Origins that are permitted to make state-changing requests.

Trait Implementations

impl Middleware for OriginGuardMiddleware

fn process<'life0, 'async_trait>( &'life0 self, request: Request, next: Arc<dyn Handler>, ) -> Pin<Box<dyn Future<Output = Result<Response, Error>> + Send + 'async_trait>>

where 'life0: 'async_trait, OriginGuardMiddleware: 'async_trait,

Processes a request through this middleware.

fn should_continue(&self, _request: &Request) -> bool

Determines whether this middleware should be executed for the given request.