Module security_headers 

Security response headers, including a Content-Security-Policy builder

SecurityHeaders adds the headers every response should carry. A header the handler already set is left alone, so one route can loosen the policy.

use ullun::prelude::*;
use ullun::security_headers::{Csp, SecurityHeaders};

App::new()
    .middleware(SecurityHeaders::new().csp(Csp::web().script_src(["'self'", "'nonce-{nonce}'"])))
    .get("/", |req: Request| async move {
        // the nonce is fresh for every request
        let nonce = req.csp_nonce().unwrap_or_default().to_string();
        Ok(Response::html(format!("<script nonce=\"{nonce}\">console.log(1)</script>")))
    })
    .run("127.0.0.1:3000")
    .await
    .unwrap();

Defaults of SecurityHeaders::new: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer, Cross-Origin-Opener-Policy: same-origin, Cross-Origin-Resource-Policy: same-origin and a Permissions-Policy that switches off camera, microphone, geolocation and payment. HSTS is a separate middleware (crate::secure::Hsts) because it only belongs on HTTPS.

Structs

Csp

A Content-Security-Policy under construction

SecurityHeaders

Middleware adding security headers, see the module documentation

Enums

FrameOptions

Value of X-Frame-Options