Struct ContentSecurityPolicy 

pub struct ContentSecurityPolicy<'a> { /* private fields */ }

Manages Content-Security-Policy header

The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (XSS).

Examples

use helmet_core::ContentSecurityPolicy;

let content_security_policy = ContentSecurityPolicy::default()
   .child_src(vec!["'self'", "https://youtube.com"])
   .connect_src(vec!["'self'", "https://youtube.com"])
   .default_src(vec!["'self'", "https://youtube.com"])
   .font_src(vec!["'self'", "https://youtube.com"]);

Report only

In report only mode, the browser will not block the request, but will send a report to the specified URI.

Make sure to set the report-to directive.

use helmet_core::ContentSecurityPolicy;

let content_security_policy = ContentSecurityPolicy::default()
   .child_src(vec!["'self'", "https://youtube.com"])
   .report_to(vec!["https://example.com/report"])
   .report_only();

Implementations

impl<'a> ContentSecurityPolicy<'a>

pub fn new() -> ContentSecurityPolicy<'a>

pub fn child_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

child-src: Defines valid sources for web workers and nested browsing contexts loaded using elements such as <frame> and <iframe>.

pub fn connect_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

connect-src: Applies to XMLHttpRequest (AJAX), WebSocket or EventSource. If not allowed the browser emulates a 400 HTTP status code.

pub fn default_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

default-src: The default-src is the default policy for loading content such as JavaScript, Images, CSS, Font’s, AJAX requests, Frames, HTML5 Media. See the list of directives to see which values are allowed as default.

pub fn font_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

font-src: Defines valid sources for fonts loaded using @font-face.

pub fn frame_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

frame-src: Defines valid sources for nested browsing contexts loading using elements such as <frame> and <iframe>.

pub fn img_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

img-src: Defines valid sources of images and favicons.

pub fn manifest_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

manifest-src: Specifies which manifest can be applied to the resource.

pub fn media_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

media-src: Defines valid sources for loading media using the <audio> and <video> elements.

pub fn object_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

object-src: Defines valid sources for the <object>, <embed>, and <applet> elements.

pub fn prefetch_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

prefetch-src: Specifies which referrer to use when fetching the resource.

pub fn script_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

script-src: Defines valid sources for JavaScript.

pub fn script_src_elem(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

script-src-elem: Defines valid sources for JavaScript inline event handlers.

pub fn script_src_attr(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

script-src-attr: Defines valid sources for JavaScript inline event handlers.

pub fn style_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

style-src: Defines valid sources for stylesheets.

pub fn style_src_elem(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

style-src-elem: Defines valid sources for stylesheets inline event handlers.

pub fn style_src_attr(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

style-src-attr: Defines valid sources for stylesheets inline event handlers.

pub fn worker_src(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

worker-src: Defines valid sources for Worker, SharedWorker, or ServiceWorker scripts.

pub fn base_uri(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

base-uri: Restricts the URLs which can be used in a document’s <base> element.

pub fn sandbox(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

sandbox: Enables a sandbox for the requested resource similar to the iframe sandbox attribute. The sandbox applies a same origin policy, prevents popups, plugins and script execution is blocked. You can keep the sandbox value empty to keep all restrictions in place, or add values: allow-forms allow-same-origin allow-scripts allow-popups, allow-modals, allow-orientation-lock, allow-pointer-lock, allow-presentation, allow-popups-to-escape-sandbox, allow-top-navigation, allow-top-navigation-by-user-activation.

pub fn form_action(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

form-action: Restricts the URLs which can be used as the target of a form submissions from a given context.

pub fn frame_ancestors(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

frame-ancestors: Specifies valid parents that may embed a page using <frame>, <iframe>, <object>, <embed>, or <applet>.

pub fn report_to(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

report-to: Enables reporting of violations.

pub fn require_trusted_types_for( self, values: Vec<&'a str>, ) -> ContentSecurityPolicy<'a>

require-trusted-types-for: Specifies which trusted types are required by a resource.

pub fn trusted_types(self, values: Vec<&'a str>) -> ContentSecurityPolicy<'a>

trusted-types: Specifies which trusted types are defined by a resource.

pub fn upgrade_insecure_requests(self) -> ContentSecurityPolicy<'a>

Block HTTP requests on insecure elements.

pub fn report_only(self) -> ContentSecurityPolicy<'a>

Enable report only mode

When set to true, the Content-Security-Policy-Report-Only header is set instead of Content-Security-Policy.

Defaults to false.

See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only

Trait Implementations

impl<'a> Clone for ContentSecurityPolicy<'a>

fn clone(&self) -> ContentSecurityPolicy<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for ContentSecurityPolicy<'_>

fn default() -> ContentSecurityPolicy<'_>

Default policy for the Content-Security-Policy header.

values:

default-src 'self';
base-uri 'self';
font-src 'self' https: data:;
form-action 'self';
frame-ancestors 'self';
img-src 'self' data:;
object-src 'none';
script-src 'self';
script-src-attr 'none';
style-src 'self' https: 'unsafe-inline';
upgrade-insecure-requests

impl Display for ContentSecurityPolicy<'_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Into<(&'static str, String)> for ContentSecurityPolicy<'_>

fn into(self) -> (&'static str, String)

Converts this type into the (usually inferred) input type.