Module secure 

HTTPS policy: redirect plain HTTP, send HSTS

use ullun::prelude::*;
use ullun::secure::{Hsts, RequireHttps};

// port 80: nothing but a redirect to https
let redirect = App::new().middleware(RequireHttps::new().https_port(8443));
// port 8443 (TLS configured with App::tls): the real application
let app = App::new()
    .middleware(Hsts::new())
    .get("/", |_req: Request| async { Ok(Response::text("secure")) });

Behind a reverse proxy that terminates TLS the application itself sees plain HTTP: tell both middleware to believe X-Forwarded-Proto with trust_forwarded_proto(), and only do that when the proxy overwrites the header (a client could otherwise claim to be secure).

Structs

Hsts

Strict-Transport-Security on responses to secure requests

RequireHttps

Redirect (308) every plain-HTTP request to the same URL on HTTPS