Crate tide_helmet 

tide-helmet is a security middleware for the Tide web framework that sets various HTTP headers to help protect your app.

tide_helmet::Helmet is a middleware that automatically sets security headers on all responses.

It is based on the Helmet library for Node.js and is highly configurable.

Usage

use tide_helmet::Helmet;

#[async_std::main]
async fn main() -> tide::Result<()> {
    let mut app = tide::new();
    app.with(Helmet::default());
    app.at("/").get(|_| async { Ok("Hello, world!") });
    app.listen("0.0.0.0:3000").await?;
    Ok(())
}

By default Helmet will set the following headers:

Content-Security-Policy: default-src 'self'; base-uri 'self'; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: no-referrer
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: sameorigin
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 0

This might be a good starting point for most users, but it is highly recommended to spend some time with the documentation for each header, and adjust them to your needs.

Configuration

By default if you construct a new instance of Helmet it will not set any headers.

It is possible to configure Helmet to set only the headers you want, by using the add method to add headers.

use tide_helmet::{Helmet, ContentSecurityPolicy, CrossOriginOpenerPolicy};

#[async_std::main]
async fn main() -> tide::Result<()> {
    let mut app = tide::new();
    app.with(
        Helmet::new()
            .add(
                ContentSecurityPolicy::new()
                    .default_src(vec!["'self'"])
                    .script_src(vec!["'self'", "https://cdn.example.com"]),
            )
            .add(CrossOriginOpenerPolicy::same_origin_allow_popups()),
    );
    app.at("/").get(|_| async { Ok("Hello, world!") });
    app.listen("0.0.0.0:3000").await?;
    Ok(())
}

Structs

ContentSecurityPolicy

Manages Content-Security-Policy header

Helmet

Helmet middleware for Tide.

OriginAgentCluster

Manages Origin-Agent-Cluster header

StrictTransportSecurity

Manages Strict-Transport-Security header

XPoweredBy

Manages X-Powered-By header

XXSSProtection

Manages X-XSS-Protection header

Enums

CrossOriginEmbedderPolicy

Manages Cross-Origin-Embedder-Policy header

CrossOriginOpenerPolicy

Manages Cross-Origin-Opener-Policy header

CrossOriginResourcePolicy

Manages Cross-Origin-Resource-Policy header

HelmetError

Error returned when a header name or value cannot be converted to a valid HTTP header.

ReferrerPolicy

Manages Referrer-Policy header

XContentTypeOptions

Manages X-Content-Type-Options header

XDNSPrefetchControl

Manages X-DNS-Prefetch-Control header

XDownloadOptions

Manages X-Download-Options header

XFrameOptions

Manages X-Frame-Options header

XPermittedCrossDomainPolicies

Manages X-Permitted-Cross-Domain-Policies header

Type Aliases

Header

Header trait