#http #tower #security #service #header

tower-helmet

Helps with securing your tower servers with various HTTP headers

2 unstable releases

0.2.0 Apr 12, 2022
0.1.0 Dec 22, 2021

#1029 in Network programming

Download history 6/week @ 2022-01-28 6/week @ 2022-02-04 4/week @ 2022-02-11 4/week @ 2022-02-18 6/week @ 2022-02-25 6/week @ 2022-03-04 11/week @ 2022-03-11 10/week @ 2022-03-18 2/week @ 2022-03-25 9/week @ 2022-04-01 32/week @ 2022-04-08 8/week @ 2022-04-15 3/week @ 2022-04-22 23/week @ 2022-04-29 15/week @ 2022-05-06 34/week @ 2022-05-13

77 downloads per month

MIT license

30KB
548 lines

tower-helmet

Crates.io Documentation License

this is still very work in progress

a port of the beautiful helmet.js in the javascript world.

tower-helmet helps you secure your tower server by setting various HTTP headers. It's not a silver bullet, but it can help!

You can find a list of all available headers under the [header] module. By default (with [HelmetLayer::default]) all of them are enabled. Please take a good look at [ContentSecurityPolicy]. Most of the time you will need to adapt this one to your needs.

Examples

use tower_helmet::header::{ContentSecurityPolicy, ExpectCt, XFrameOptions};
use tower_helmet::HelmetLayer;

// default layer with all security headers active
let layer = HelmetLayer::with_defaults();

// default layer with customizations applied
let mut directives = HashMap::new();
directives.insert("default-src", vec!["'self'", "https://example.com"]);
directives.insert("img-src", vec!["'self'", "data:", "https://example.com"]);
directives.insert("script-src", vec!["'self'", "'unsafe-inline'", "https://example.com"]);
let csp = ContentSecurityPolicy {
  directives,
  ..Default::default()
};

let layer = HelmetLayer::with_defaults().enable(csp);

// completely blank layer, selectively enable and add headers
let layer = HelmetLayer::blank()
  .enable(XFrameOptions::SameOrigin)
  .enable(ExpectCt::default());

Dependencies

~1.5MB
~25K SLoC