Module secure 

HTTPS policy: redirect plain HTTP, send HSTS

use ullun::prelude::*;
use ullun::secure::{Hsts, RequireHttps};

// port 80: nothing but a redirect to https
let redirect = App::new().middleware(RequireHttps::new().https_port(8443));
// port 8443 (TLS configured with App::tls): the real application
let app = App::new()
    .middleware(Hsts::new())
    .get("/", |_req: Request| async { Ok(Response::text("secure")) });

Behind a reverse proxy that terminates TLS the application itself sees plain HTTP: tell both middleware to believe X-Forwarded-Proto with trust_forwarded_proto(), and only do that when the proxy overwrites the header (a client could otherwise claim to be secure).

Structs

AllowedHosts

Reject requests whose Host header is not one of your names

Hsts

Strict-Transport-Security on responses to secure requests

RequireHttps

Redirect (308) every plain-HTTP request to the same URL on HTTPS