Struct ContentSecurityPolicy 

pub struct ContentSecurityPolicy { /* private fields */ }

Available on crate feature http only.

Content-Security-Policy response header.

Adding a directive that already exists in the policy replaces its source-list in place (preserving declared order). The user agent would ignore a second occurrence anyway, so we keep the value the caller most recently supplied.

Examples

use rama_http_headers::{ContentSecurityPolicy, HostSource, SourceList};

let csp = ContentSecurityPolicy::strict_self().with_img_src(
    SourceList::self_origin()
        .with_data()
        .with_host(HostSource::try_parse("https://raw.githubusercontent.com").unwrap()),
);

let rendered = csp.to_string();
assert!(rendered.contains("img-src 'self' data: https://raw.githubusercontent.com"));
assert!(rendered.contains("frame-ancestors 'none'"));

Implementations

impl ContentSecurityPolicy

pub const fn empty() -> ContentSecurityPolicy

Empty policy. Build from this when you want to add directives one at a time rather than starting from a baseline.

pub fn strict_self() -> ContentSecurityPolicy

Strict same-origin baseline:

default-src 'self'; script-src 'self'; style-src 'self';
img-src 'self'; font-src 'self'; connect-src 'self';
form-action 'self'; base-uri 'self'; frame-ancestors 'none'

pub fn directives(&self) -> impl Iterator<Item = &Directive>

Iterate the policy’s directives in encoding order.

pub fn with( self, name: impl Into<DirectiveName>, sources: SourceList, ) -> ContentSecurityPolicy

Generic escape hatch: append or replace any directive by name. If the directive already exists, its source-list is overwritten in place (order preserved); otherwise it’s appended.

pub fn set( &mut self, name: impl Into<DirectiveName>, sources: SourceList, ) -> &mut ContentSecurityPolicy

In-place sibling of with.

pub fn with_default_src(self, sources: SourceList) -> ContentSecurityPolicy

Set default-src.

pub fn set_default_src( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set default-src.

pub fn with_script_src(self, sources: SourceList) -> ContentSecurityPolicy

Set script-src.

pub fn set_script_src( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set script-src.

pub fn with_style_src(self, sources: SourceList) -> ContentSecurityPolicy

Set style-src.

pub fn set_style_src( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set style-src.

pub fn with_img_src(self, sources: SourceList) -> ContentSecurityPolicy

Set img-src.

pub fn set_img_src(&mut self, sources: SourceList) -> &mut ContentSecurityPolicy

Set img-src.

pub fn with_font_src(self, sources: SourceList) -> ContentSecurityPolicy

Set font-src.

pub fn set_font_src( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set font-src.

pub fn with_connect_src(self, sources: SourceList) -> ContentSecurityPolicy

Set connect-src.

pub fn set_connect_src( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set connect-src.

pub fn with_media_src(self, sources: SourceList) -> ContentSecurityPolicy

Set media-src.

pub fn set_media_src( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set media-src.

pub fn with_object_src(self, sources: SourceList) -> ContentSecurityPolicy

Set object-src.

pub fn set_object_src( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set object-src.

pub fn with_frame_src(self, sources: SourceList) -> ContentSecurityPolicy

Set frame-src.

pub fn set_frame_src( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set frame-src.

pub fn with_frame_ancestors(self, sources: SourceList) -> ContentSecurityPolicy

Set frame-ancestors. Note that nonces, hashes, and 'unsafe-inline' are not valid sources here per CSP3 § 6.1.2 (we don’t enforce that — just be aware).

pub fn set_frame_ancestors( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set frame-ancestors. Note that nonces, hashes, and 'unsafe-inline' are not valid sources here per CSP3 § 6.1.2 (we don’t enforce that — just be aware).

pub fn with_child_src(self, sources: SourceList) -> ContentSecurityPolicy

Set child-src.

pub fn set_child_src( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set child-src.

pub fn with_worker_src(self, sources: SourceList) -> ContentSecurityPolicy

Set worker-src.

pub fn set_worker_src( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set worker-src.

pub fn with_manifest_src(self, sources: SourceList) -> ContentSecurityPolicy

Set manifest-src.

pub fn set_manifest_src( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set manifest-src.

pub fn with_form_action(self, sources: SourceList) -> ContentSecurityPolicy

Set form-action.

pub fn set_form_action( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set form-action.

pub fn with_base_uri(self, sources: SourceList) -> ContentSecurityPolicy

Set base-uri.

pub fn set_base_uri( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set base-uri.

pub fn with_navigate_to(self, sources: SourceList) -> ContentSecurityPolicy

Set navigate-to.

pub fn set_navigate_to( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set navigate-to.

pub fn with_report_to(self, sources: SourceList) -> ContentSecurityPolicy

Set report-to.

pub fn set_report_to( &mut self, sources: SourceList, ) -> &mut ContentSecurityPolicy

Set report-to.

pub fn with_upgrade_insecure_requests(self) -> ContentSecurityPolicy

Set the valueless upgrade-insecure-requests directive.

pub fn set_upgrade_insecure_requests(&mut self) -> &mut ContentSecurityPolicy

Set the valueless upgrade-insecure-requests directive.

Trait Implementations

impl Clone for ContentSecurityPolicy

fn clone(&self) -> ContentSecurityPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ContentSecurityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for ContentSecurityPolicy

fn default() -> ContentSecurityPolicy

Returns the “default value” for a type.

impl Display for ContentSecurityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl HeaderDecode for ContentSecurityPolicy

fn decode<'i, I>(values: &mut I) -> Result<ContentSecurityPolicy, Error>

where I: Iterator<Item = &'i HeaderValue>,

Decode this type from an iterator of HeaderValues.

impl HeaderEncode for ContentSecurityPolicy

fn encode<E>(&self, values: &mut E)

where E: Extend<HeaderValue>,

Encode this type to a HeaderValue, and add it to a container which has HeaderValue type as each element.

fn encode_to_value(&self) -> Option<HeaderValue>

Encode this header to HeaderValue.

impl PartialEq for ContentSecurityPolicy

fn eq(&self, other: &ContentSecurityPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl TypedHeader for ContentSecurityPolicy

fn name() -> &'static HeaderName

The name of this header.

impl Eq for ContentSecurityPolicy

impl StructuralPartialEq for ContentSecurityPolicy