tower_helmet/header/
x_frame_options.rs

1use std::fmt::{Display, Formatter};
2
3use http::header::{HeaderName, InvalidHeaderValue};
4use http::HeaderValue;
5
6use crate::IntoHeader;
7
8/// `XFrameOptions` sets the `X-Frame-Options` header to help you mitigate [clickjacking attacks](https://en.wikipedia.org/wiki/Clickjacking).
9/// This header is superseded by [the `frame-ancestors` Content Security Policy directive](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors) but is still useful on old browsers.
10/// For more, see `helmet.contentSecurityPolicy`, as well as [the documentation on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options).
11///
12/// `DENY` or `SAMEORIGIN`. (A legacy directive, `ALLOW-FROM`, is not supported by this crate. [Read more here.](https://github.com/helmetjs/helmet/wiki/How-to-use-X%E2%80%93Frame%E2%80%93Options's-%60ALLOW%E2%80%93FROM%60-directive))
13#[derive(Debug, Clone, Copy, Default)]
14pub enum XFrameOptions {
15    Deny,
16    #[default]
17    SameOrigin,
18}
19
20impl Display for XFrameOptions {
21    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
22        let s = match self {
23            XFrameOptions::SameOrigin => "SAMEORIGIN",
24            XFrameOptions::Deny => "DENY",
25        };
26
27        write!(f, "{}", s)
28    }
29}
30
31impl IntoHeader for XFrameOptions {
32    fn header_name(&self) -> HeaderName {
33        http::header::X_FRAME_OPTIONS
34    }
35
36    fn header_value(&self) -> Result<HeaderValue, InvalidHeaderValue> {
37        HeaderValue::from_str(self.to_string().as_str())
38    }
39}
tower_helmet/header/x_frame_options.rs

tower_helmet/header/
x_frame_options.rs
