Struct SecurityConfig 

pub struct SecurityConfig {

    pub csrf: bool,
    pub csrf_cookie_secure: bool,
    pub signed_csrf: bool,
    pub session_bind_cookie: Option<String>,
    pub csrf_exempt_paths: Vec<String>,
    pub content_type_options: bool,
    pub frame_options: Option<String>,
    pub referrer_policy: Option<String>,
    pub xss_protection: Option<String>,
    pub hsts: bool,
    pub hsts_max_age: u64,
    pub hsts_include_subdomains: bool,
    pub hsts_preload: bool,
    pub content_security_policy: Option<String>,
    pub permissions_policy: Option<String>,
    pub cross_origin_opener_policy: Option<String>,
    pub cross_origin_resource_policy: Option<String>,
    pub cross_origin_embedder_policy: Option<String>,
    pub server_header: Option<String>,
    pub hide_server_header: bool,
    pub request_body_limit: Option<usize>,
    pub redact_sensitive_headers: bool,
    pub private_cache: bool,
}

Declarative security configuration. Build from Default (secure, dev-safe) and override the fields you need — see the crate docs for the rationale behind each default.

Fields

csrf: bool

Run the CSRF middleware. Default true.

csrf_cookie_secure: bool

Force the Secure flag on the CSRF cookie. Default false; Secure is added automatically under Environment::Prod regardless, so this only matters for forcing it on in a non-prod HTTPS setup.

signed_csrf: bool

Sign the CSRF token with the app secret_key (HMAC-SHA256). Default true — the middleware is the only mint, so every token carries a signature; stale unsigned cookies rotate automatically on the next safe request. Set false for plain double-submit.

session_bind_cookie: Option<String>

When signed_csrf is on, also bind the token to this cookie’s value (typically the session cookie). Default None.

csrf_exempt_paths: Vec<String>

Request-path prefixes exempt from CSRF (CSRF-exempt paths). A token-authenticated REST API carries no session cookie, so a bearer-auth POST /api/... would otherwise 403; exempt "/api" to keep it working. Matched as a path prefix. Default empty.

content_type_options: bool

X-Content-Type-Options: nosniff. Default true.

frame_options: Option<String>

X-Frame-Options. Default Some("DENY").

referrer_policy: Option<String>

Referrer-Policy. Default Some("strict-origin-when-cross-origin").

xss_protection: Option<String>

X-XSS-Protection. Default Some("0") — disables the buggy legacy filter rather than enabling it (current OWASP guidance).

hsts: bool

Emit Strict-Transport-Security. Default false (dev-safe). Value is built from the hsts_* fields.

hsts_max_age: u64

HSTS max-age in seconds. Default one year.

hsts_include_subdomains: bool

Add ; includeSubDomains to HSTS. Default true.

hsts_preload: bool

Add ; preload to HSTS. Default false.

content_security_policy: Option<String>

Content-Security-Policy. Default None — a wrong CSP breaks apps, so it’s opt-in.

permissions_policy: Option<String>

Permissions-Policy. Default None.

cross_origin_opener_policy: Option<String>

Cross-Origin-Opener-Policy. Default Some("same-origin"). Set None to omit, e.g. apps relying on cross-origin popups (some OAuth flows).

cross_origin_resource_policy: Option<String>

Cross-Origin-Resource-Policy (e.g. "same-origin"). Default None.

cross_origin_embedder_policy: Option<String>

Cross-Origin-Embedder-Policy (e.g. "require-corp"). Default None.

server_header: Option<String>

Set the Server response header. Default Some("umbral") — a bare product name (no version, so no info disclosure), the way many app servers advertise one. Set None to omit. Prefer no version.

hide_server_header: bool

Strip any Server header the stack set. Default false. Ignored when server_header is Some (the set wins) — to strip, also set server_header: None.

request_body_limit: Option<usize>

Cap request body size in bytes (tower-http RequestBodyLimitLayer). Default None (axum’s own default applies).

redact_sensitive_headers: bool

Mark authorization / cookie / set-cookie sensitive so tracing redacts them. Default true.

private_cache: bool

Send Cache-Control: no-store, private on responses to personalised requests — those carrying a session cookie or an Authorization / Proxy-Authorization header. Default true.

An authenticated page holds the viewer’s data and their CSRF token (double-submit, so the token is deliberately readable — see the module docs). Without this header nothing tells a CDN, a corporate proxy, or the browser’s back/forward cache that the page belongs to one person. private stops shared caches; no-store stops the local disk cache replaying an admin page after logout.

Anonymous requests are untouched, so public pages stay cacheable, and a handler that sets its own Cache-Control always wins. Turn this off only if a cache you control already keys on the session cookie.

Implementations

impl SecurityConfig

pub fn production_hardened() -> Self

A production-grade preset (audit_2 plugin-authz S1). The defaults are deliberately dev-safe — HSTS, CSP, and cross-origin isolation are OFF so local HTTP dev works — but that leaves a default deployment without an XSS backstop (no CSP) or SSL-stripping protection (no HSTS). Rather than have every operator hand-assemble a config and risk forgetting one, this turns on the headline prod headers in a single call:

• hsts + hsts_preload (long max-age, subdomains, preload-eligible),
• a strict content_security_policy baseline (default-src 'self' with frame-ancestors 'none', base-uri 'self', form-action 'self') — loosen it per app as needed,
• cross_origin_resource_policy: same-origin (COOP is already same-origin by default),
• csrf_cookie_secure (prod serves over HTTPS, so the CSRF cookie should carry the Secure attribute).

Everything else keeps the secure defaults (csrf, signed_csrf, nosniff, X-Frame-Options: DENY, referrer policy). Note the strict CSP has no 'unsafe-inline', so inline <script>/<style> won’t run — adjust the policy for your asset strategy.

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> SecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> Self

Returns the “default value” for a type.