tower-helmet/README.md

42 lines
1.6 KiB
Markdown
Raw Normal View History

2021-12-22 20:42:00 +02:00
# tower-helmet
2021-12-22 20:46:54 +02:00
[![Crates.io](https://img.shields.io/crates/v/tower-helmet)](https://crates.io/crates/tower-helmet)
[![Documentation](https://docs.rs/tower-helmet/badge.svg)](https://docs.rs/tower-helmet)
[![License](https://img.shields.io/crates/l/tower-helmet)](LICENSE)
2021-12-22 20:42:00 +02:00
this is still very **work in progress**
a port of the beautiful [helmet.js](https://github.com/helmetjs/helmet) in the javascript world.
`tower-helmet` helps you secure your tower server by setting various HTTP headers. _It's not a silver bullet_, but it can help!
You can find a list of all available headers under the [header] module. By default (with [HelmetLayer::default]) **all of them** are enabled.
Please take a good look at [ContentSecurityPolicy]. Most of the time you will need to adapt this one to your needs.
# Examples
```rust
use tower_helmet::header::{ContentSecurityPolicy, ExpectCt, XFrameOptions};
use tower_helmet::HelmetLayer;
// default layer with all security headers active
2022-04-12 22:33:27 +03:00
let layer = HelmetLayer::with_defaults();
2021-12-22 20:42:00 +02:00
// default layer with customizations applied
let mut directives = HashMap::new();
directives.insert("default-src", vec!["'self'", "https://example.com"]);
directives.insert("img-src", vec!["'self'", "data:", "https://example.com"]);
directives.insert("script-src", vec!["'self'", "'unsafe-inline'", "https://example.com"]);
let csp = ContentSecurityPolicy {
directives,
..Default::default()
};
2022-04-12 22:33:27 +03:00
let layer = HelmetLayer::with_defaults().enable(csp);
2021-12-22 20:42:00 +02:00
// completely blank layer, selectively enable and add headers
2022-04-12 22:33:27 +03:00
let layer = HelmetLayer::blank()
.enable(XFrameOptions::SameOrigin)
.enable(ExpectCt::default());
2021-12-22 20:42:00 +02:00
```