| 1 | //! Security headers applied to every response (unless a handler set its own). |
| 2 | |
| 3 | use axum::http::{HeaderName, HeaderValue, header}; |
| 4 | use tower_http::set_header::SetResponseHeaderLayer; |
| 5 | |
| 6 | pub const PAGE_CSP: &str = "default-src 'self'; img-src 'self' https: data:; script-src 'self'; \ |
| 7 | object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"; |
| 8 | |
| 9 | pub fn layers() -> [SetResponseHeaderLayer<HeaderValue>; 5] { |
| 10 | let set = |name: HeaderName, value: &'static str| { |
| 11 | SetResponseHeaderLayer::if_not_present(name, HeaderValue::from_static(value)) |
| 12 | }; |
| 13 | [ |
| 14 | set(header::CONTENT_SECURITY_POLICY, PAGE_CSP), |
| 15 | set(header::X_CONTENT_TYPE_OPTIONS, "nosniff"), |
| 16 | set(header::REFERRER_POLICY, "same-origin"), |
| 17 | set(header::X_FRAME_OPTIONS, "DENY"), |
| 18 | set( |
| 19 | HeaderName::from_static("cross-origin-opener-policy"), |
| 20 | "same-origin", |
| 21 | ), |
| 22 | ] |
| 23 | } |