DocsServer features
Security middleware
Apply a PulsePoint-compatible browser security baseline to every response, with explicit application-owned overrides.
Generated once, applied everywhere
The generated router installs security headers automatically around pages, RPCs, APIs, redirects, probes, development endpoints, 404s, and public files. An existing response header wins, allowing a route or proxy to enforce a stricter value.
| Header | Default purpose |
|---|---|
| Content-Security-Policy | Restricts loading, framing, forms, base URLs, and plugins. |
| Permissions-Policy | Limits camera, geolocation, microphone, payment, and USB. |
| Referrer-Policy | Keeps paths and queries out of cross-origin referrers. |
| X-Content-Type-Options | Disables MIME guessing. |
| X-Frame-Options | Adds legacy same-origin framing protection. |
| Strict-Transport-Security | One year with subdomains outside development. |
Content Security Policy
The default locks default-src 'self', object-src 'none', base-uri 'self', form-action 'self', and frame-ancestors 'self'. Applications should replace broad HTTPS allowances with the exact external hosts they use.
Replace the policy during startup
use rahti::security::{self, SecurityHeaders};
security::configure(SecurityHeaders {
content_security_policy: Some(
"default-src 'self'; \
script-src 'self' 'unsafe-inline' 'unsafe-eval'; \
style-src 'self' 'unsafe-inline'; \
img-src 'self' data:; connect-src 'self' ws: wss:; \
object-src 'none'; base-uri 'self'; \
form-action 'self'; frame-ancestors 'self'".into(),
),
// This deployment's proxy owns HSTS.
strict_transport_security: None,
..SecurityHeaders::default()
});Each field is an Option<String>; None omits it. Malformed values fail configuration. Disable HSTS subdomains when any subdomain is not HTTPS, or when the reverse proxy owns that policy.
What headers do not replace
Keep using escaped rendering, validation, authentication, authorization, and the generated CSRF layer. Security headers constrain a browser; they do not decide whether a caller or mutation is valid.