Struct XFrameOptionsMiddleware 

pub struct XFrameOptionsMiddleware { /* private fields */ }

Available on (crate features standard or middleware) and native only.

X-Frame-Options middleware for clickjacking protection

Implementations

impl XFrameOptionsMiddleware

pub fn deny() -> XFrameOptionsMiddleware

Create middleware with DENY option

Prevents the page from being displayed in any frame, providing maximum clickjacking protection.

Examples

use std::sync::Arc;
use reinhardt_middleware::XFrameOptionsMiddleware;
use reinhardt_http::{Handler, Middleware, Request, Response};
use hyper::{StatusCode, Method, Version, HeaderMap};
use bytes::Bytes;

struct TestHandler;

#[async_trait::async_trait]
impl Handler for TestHandler {
    async fn handle(&self, _request: Request) -> reinhardt_core::exception::Result<Response> {
        Ok(Response::new(StatusCode::OK))
    }
}

let middleware = XFrameOptionsMiddleware::deny();
let handler = Arc::new(TestHandler);

let request = Request::builder()
    .method(Method::GET)
    .uri("/secure-page")
    .version(Version::HTTP_11)
    .headers(HeaderMap::new())
    .body(Bytes::new())
    .build()
    .unwrap();

let response = middleware.process(request, handler).await.unwrap();
assert_eq!(response.headers.get("X-Frame-Options").unwrap(), "DENY");

pub fn same_origin() -> XFrameOptionsMiddleware

Create middleware with SAMEORIGIN option

Allows the page to be framed only by pages from the same origin.

Examples

use std::sync::Arc;
use reinhardt_middleware::XFrameOptionsMiddleware;
use reinhardt_http::{Handler, Middleware, Request, Response};
use hyper::{StatusCode, Method, Version, HeaderMap};
use bytes::Bytes;

struct TestHandler;

#[async_trait::async_trait]
impl Handler for TestHandler {
    async fn handle(&self, _request: Request) -> reinhardt_core::exception::Result<Response> {
        Ok(Response::new(StatusCode::OK))
    }
}

let middleware = XFrameOptionsMiddleware::same_origin();
let handler = Arc::new(TestHandler);

let request = Request::builder()
    .method(Method::GET)
    .uri("/dashboard")
    .version(Version::HTTP_11)
    .headers(HeaderMap::new())
    .body(Bytes::new())
    .build()
    .unwrap();

let response = middleware.process(request, handler).await.unwrap();
assert_eq!(response.headers.get("X-Frame-Options").unwrap(), "SAMEORIGIN");

pub fn new(option: XFrameOptions) -> XFrameOptionsMiddleware

Create middleware with custom option

Arguments

• option - The X-Frame-Options value to use

Examples

use std::sync::Arc;
use reinhardt_middleware::{XFrameOptionsMiddleware, XFrameOptions};
use reinhardt_http::{Handler, Middleware, Request, Response};
use hyper::{StatusCode, Method, Version, HeaderMap};
use bytes::Bytes;

struct TestHandler;

#[async_trait::async_trait]
impl Handler for TestHandler {
    async fn handle(&self, _request: Request) -> reinhardt_core::exception::Result<Response> {
        Ok(Response::new(StatusCode::OK))
    }
}

let middleware = XFrameOptionsMiddleware::new(XFrameOptions::Deny);
let handler = Arc::new(TestHandler);

let request = Request::builder()
    .method(Method::GET)
    .uri("/admin")
    .version(Version::HTTP_11)
    .headers(HeaderMap::new())
    .body(Bytes::new())
    .build()
    .unwrap();

let response = middleware.process(request, handler).await.unwrap();
assert_eq!(response.headers.get("X-Frame-Options").unwrap(), "DENY");

Trait Implementations

impl Default for XFrameOptionsMiddleware

fn default() -> XFrameOptionsMiddleware

Returns the “default value” for a type.

impl Middleware for XFrameOptionsMiddleware

fn process<'life0, 'async_trait>( &'life0 self, request: Request, handler: Arc<dyn Handler>, ) -> Pin<Box<dyn Future<Output = Result<Response, Error>> + Send + 'async_trait>>

where 'life0: 'async_trait, XFrameOptionsMiddleware: 'async_trait,

Processes a request through this middleware.

fn should_continue(&self, _request: &Request) -> bool

Determines whether this middleware should be executed for the given request.