Struct SecurityHeadersConfig 

#[non_exhaustive]
pub struct SecurityHeadersConfig {
    pub x_content_type_options: Option<String>,
    pub x_frame_options: Option<String>,
    pub cache_control: Option<String>,
    pub referrer_policy: Option<String>,
    pub cross_origin_opener_policy: Option<String>,
    pub cross_origin_resource_policy: Option<String>,
    pub cross_origin_embedder_policy: Option<String>,
    pub permissions_policy: Option<String>,
    pub x_permitted_cross_domain_policies: Option<String>,
    pub content_security_policy: Option<String>,
    pub x_dns_prefetch_control: Option<String>,
    pub strict_transport_security: Option<String>,
}

Per-header overrides for the OWASP security headers emitted by the global response middleware.

Each field follows a three-state semantic:

Value	Behaviour
None	Use the built-in default (current behaviour).
Some("")	Omit the header entirely from responses.
Some(value)	Emit header: value. Validated at config-load time.

All non-empty values are validated via axum::http::HeaderValue::from_str inside McpServerConfig::validate; invalid values fail fast before the server starts accepting traffic.

Strict-Transport-Security has an additional rule: the substring preload (case-insensitive) is rejected. Operators who want to commit to the HSTS preload list must do so via a future explicit builder method, not by smuggling it through this knob.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

x_content_type_options: Option<String>

Override for X-Content-Type-Options. Default: nosniff.

x_frame_options: Option<String>

Override for X-Frame-Options. Default: deny.

cache_control: Option<String>

Override for Cache-Control. Default: no-store, max-age=0.

referrer_policy: Option<String>

Override for Referrer-Policy. Default: no-referrer.

cross_origin_opener_policy: Option<String>

Override for Cross-Origin-Opener-Policy. Default: same-origin.

cross_origin_resource_policy: Option<String>

Override for Cross-Origin-Resource-Policy. Default: same-origin.

cross_origin_embedder_policy: Option<String>

Override for Cross-Origin-Embedder-Policy. Default: require-corp.

permissions_policy: Option<String>

Override for Permissions-Policy. Default: accelerometer=(), camera=(), geolocation=(), microphone=().

x_permitted_cross_domain_policies: Option<String>

Override for X-Permitted-Cross-Domain-Policies. Default: none.

content_security_policy: Option<String>

Override for Content-Security-Policy. Default: default-src 'none'; frame-ancestors 'none'.

x_dns_prefetch_control: Option<String>

Override for X-DNS-Prefetch-Control. Default: off.

strict_transport_security: Option<String>

Override for Strict-Transport-Security. Default (TLS only): max-age=63072000; includeSubDomains. Only emitted when TLS is active; the override is ignored on plaintext deployments. The substring preload (any case) is rejected by the validator.

Trait Implementations

impl Clone for SecurityHeadersConfig

fn clone(&self) -> SecurityHeadersConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityHeadersConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityHeadersConfig

fn default() -> SecurityHeadersConfig

Returns the “default value” for a type.