juicehost/
middleware.rs

1//! Security response-header middleware.
2
3use axum::{
4    body::Body,
5    http::{header, HeaderValue, Request},
6    middleware::Next,
7    response::Response,
8};
9
10/// Adds security response headers like X-Content-Type-Options, CSP, and so on.
11pub async fn add_security_headers(req: Request<Body>, next: Next) -> Response {
12    let mut response = next.run(req).await;
13    let headers = response.headers_mut();
14
15    headers.insert(
16        header::X_CONTENT_TYPE_OPTIONS,
17        HeaderValue::from_static("nosniff"),
18    );
19    headers.insert(header::X_FRAME_OPTIONS, HeaderValue::from_static("DENY"));
20    headers.insert(
21        header::CONTENT_SECURITY_POLICY,
22        HeaderValue::from_static(
23            "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'",
24        ),
25    );
26    headers.insert(
27        "referrer-policy",
28        HeaderValue::from_static("strict-origin-when-cross-origin"),
29    );
30    headers.insert(
31        "permissions-policy",
32        HeaderValue::from_static("geolocation=(), microphone=(), camera=()"),
33    );
34
35    response
36}
juicehost/middleware.rs

juicehost/
middleware.rs
