Struct SecurityHeaders

Source

pub struct SecurityHeaders { /* private fields */ }

Expand description

The security headers added to every reply web-net sends (pages, error pages, files, redirects), unless the handler set the same field itself.

The defaults are strict: a page may load scripts, styles, images, and fonts from its own origin only, may not be framed, and sends a short referrer to other origins. A site that needs more says so.

use web_net::SecurityHeaders;

let policy = SecurityHeaders::default()
    .content_security_policy("default-src 'self'; img-src 'self' https://cdn.example; frame-ancestors 'none'")
    .hsts(63_072_000, true);

Implementations§

Source §

impl SecurityHeaders

Source

pub fn none() -> Self

No security headers at all (x-content-type-options: nosniff is still sent: it has no cost and no downside).

use web_net::{App, SecurityHeaders, get};

let app = App::builder()
    .security_headers(SecurityHeaders::none())
    .route(get("/", |cx| cx.text(200, "ok")))
    .build()?;
let r = serve_net::testing::respond(&app, b"GET / HTTP/1.1\r\nHost: localhost\r\n\r\n");
assert!(r.header("content-security-policy").is_none());
assert_eq!(r.header("x-content-type-options"), Some(&b"nosniff"[..]));

Source

pub fn content_security_policy(self, value: &str) -> Self

Content-Security-Policy.

use web_net::{App, SecurityHeaders, get};

let app = App::builder()
    .security_headers(SecurityHeaders::default().content_security_policy("default-src 'self'"))
    .route(get("/", |cx| cx.text(200, "ok")))
    .build()?;
let r = serve_net::testing::respond(&app, b"GET / HTTP/1.1\r\nHost: localhost\r\n\r\n");
assert_eq!(r.header("content-security-policy"), Some(&b"default-src 'self'"[..]));

Source

pub fn no_content_security_policy(self) -> Self

No Content-Security-Policy.

use web_net::{App, SecurityHeaders, get};

let app = App::builder()
    .security_headers(SecurityHeaders::default().no_content_security_policy())
    .route(get("/", |cx| cx.text(200, "ok")))
    .build()?;
let r = serve_net::testing::respond(&app, b"GET / HTTP/1.1\r\nHost: localhost\r\n\r\n");
assert_eq!(r.header("content-security-policy"), None);

Source

pub fn frame_options(self, value: &str) -> Self

X-Frame-Options (DENY by default; SAMEORIGIN to allow the site’s own frames).

use web_net::{App, SecurityHeaders, get};

let app = App::builder()
    .security_headers(SecurityHeaders::default().frame_options("SAMEORIGIN"))
    .route(get("/", |cx| cx.text(200, "ok")))
    .build()?;
let r = serve_net::testing::respond(&app, b"GET / HTTP/1.1\r\nHost: localhost\r\n\r\n");
assert_eq!(r.header("x-frame-options"), Some(&b"SAMEORIGIN"[..]));

Source

pub fn referrer_policy(self, value: &str) -> Self

Referrer-Policy.

use web_net::{App, SecurityHeaders, get};

let app = App::builder()
    .security_headers(SecurityHeaders::default().referrer_policy("no-referrer"))
    .route(get("/", |cx| cx.text(200, "ok")))
    .build()?;
let r = serve_net::testing::respond(&app, b"GET / HTTP/1.1\r\nHost: localhost\r\n\r\n");
assert_eq!(r.header("referrer-policy"), Some(&b"no-referrer"[..]));

Source

pub fn permissions_policy(self, value: &str) -> Self

Permissions-Policy.

use web_net::{App, SecurityHeaders, get};

let app = App::builder()
    .security_headers(SecurityHeaders::default().permissions_policy("camera=(self)"))
    .route(get("/", |cx| cx.text(200, "ok")))
    .build()?;
let r = serve_net::testing::respond(&app, b"GET / HTTP/1.1\r\nHost: localhost\r\n\r\n");
assert_eq!(r.header("permissions-policy"), Some(&b"camera=(self)"[..]));

Source

pub fn opener_policy(self, value: &str) -> Self

Cross-Origin-Opener-Policy.

use web_net::{App, SecurityHeaders, get};

let app = App::builder()
    .security_headers(SecurityHeaders::default().opener_policy("same-origin-allow-popups"))
    .route(get("/", |cx| cx.text(200, "ok")))
    .build()?;
let r = serve_net::testing::respond(&app, b"GET / HTTP/1.1\r\nHost: localhost\r\n\r\n");
assert_eq!(r.header("cross-origin-opener-policy"), Some(&b"same-origin-allow-popups"[..]));

Source

pub fn hsts(self, max_age: u64, include_subdomains: bool) -> Self

Strict-Transport-Security, sent on HTTPS replies only and never to a development host. include_subdomains commits every subdomain to HTTPS too: set it only when they all have it.

use web_net::{App, SecurityHeaders, get};

let app = App::builder()
    .host("example.com")
    .security_headers(SecurityHeaders::default().hsts(63_072_000, true))
    .route(get("/", |cx| cx.text(200, "ok")))
    .build()?;
let r = serve_net::testing::TestRequest::new(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n")
    .scheme(serve_net::Scheme::Https)
    .send(&app);
assert_eq!(r.header("strict-transport-security"), Some(&b"max-age=63072000; includeSubDomains"[..]));

Source

pub fn no_hsts(self) -> Self

No Strict-Transport-Security.

use web_net::{App, SecurityHeaders, get};

let app = App::builder()
    .host("example.com")
    .security_headers(SecurityHeaders::default().no_hsts())
    .route(get("/", |cx| cx.text(200, "ok")))
    .build()?;
let r = serve_net::testing::TestRequest::new(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n")
    .scheme(serve_net::Scheme::Https)
    .send(&app);
assert_eq!(r.header("strict-transport-security"), None);