Struct ServerConfig 

pub struct ServerConfig {
    pub allowed_origins: Vec<String>,
    pub api_key: Option<String>,
    pub require_auth_for_metrics: bool,
}

HTTP server configuration.

Controls CORS, authentication, and other HTTP-related security settings.

Security

CWE-942 (Overly Permissive CORS), CWE-306 (Missing Authentication): Production deployments should configure explicit allowed_origins and enable API key authentication.

Fields

allowed_origins: Vec<String>

Allowed CORS origins.

• Empty vector: No CORS headers (most restrictive)
• ["*"]: Allow all origins (NOT RECOMMENDED for production)
• Explicit list: Only allow specified origins (RECOMMENDED)

Security

CWE-942: Using ["*"] allows any website to make requests to your server, potentially exposing sensitive data.

api_key: Option<String>

Optional API key for request authentication.

When set, all API requests must include the header: X-API-Key: <key>

Security

CWE-306: Without authentication, any client can execute queries. Enable this for any deployment accessible beyond localhost.

require_auth_for_metrics: bool

Whether to require API key for metrics endpoint.

Default: false (metrics are public for observability tooling)

Implementations

impl ServerConfig

pub fn development() -> Self

Create a permissive config for local development only.

Security

WARNING: Do not use in production. This config allows all CORS origins and has no authentication.

pub fn production(allowed_origins: Vec<String>, api_key: String) -> Self

Create a production config with explicit origins and required API key.

Panics

Panics if api_key is empty.

pub fn security_warning(&self) -> Option<&'static str>

Returns a security warning if the config is insecure.

Trait Implementations

impl Clone for ServerConfig

fn clone(&self) -> ServerConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ServerConfig

fn default() -> Self

Returns the “default value” for a type.