Struct SecurityHeaders 

pub struct SecurityHeaders {
    pub hsts_max_age_secs: Option<u64>,
    pub hsts_include_subdomains: bool,
    pub hsts_preload: bool,
    pub nosniff: bool,
    pub content_security_policy: Option<String>,
    pub frame_options: Option<FrameOptions>,
}

Security-header injection policy (DW-028, feature analysis 5-Security “security header injection”). Each field that is present injects (REPLACING any upstream-sent value — the gateway is the source of truth at its edge) exactly one standard hardening header on every response the route emits, including gateway short-circuits (401/403/413/429/503, CORS preflights): unlike deprecation stamps, these harden every byte the edge sends, and a browser parsing an error page deserves the same guarantees as one parsing a 200.

Not on responses with no route to consult: the framing 400 (the pre-parse sniff rejects the request before any route exists) and unrouted 404s.

Fields

hsts_max_age_secs: Option<u64>

Emit Strict-Transport-Security: max-age=<secs> (RFC 6797) on every response of the route. The presence of this field is the policy; 0 is rejected (max-age=0 is the spec’s deletion signal, a state this policy cannot express — delete the field instead).

hsts_include_subdomains: bool

Append the includeSubDomains directive to the HSTS header (meaningful only with hsts_max_age_secs; rejected alone by validation).

hsts_preload: bool

Append the preload directive to the HSTS header (the HSTS preload-list signal; meaningful only with hsts_max_age_secs and, per the preload list requirements, with hsts_include_subdomains; that combination is enforced by validation).

nosniff: bool

Emit X-Content-Type-Options: nosniff (the MIME-sniffing off-switch; the only value the header has).

content_security_policy: Option<String>

Emit Content-Security-Policy: <policy> verbatim (the operator authors the policy; non-empty and header-representable, validation — a trailing newline or other control byte is rejected rather than silently not emitted).

frame_options: Option<FrameOptions>

Emit X-Frame-Options (legacy but still load-bearing for older browsers). ALLOW-FROM is obsolete and deliberately absent.

Trait Implementations

impl Clone for SecurityHeaders

fn clone(&self) -> SecurityHeaders

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityHeaders

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecurityHeaders

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for SecurityHeaders

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for SecurityHeaders

fn eq(&self, other: &SecurityHeaders) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SecurityHeaders

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SecurityHeaders