Enum Hsts

pub enum Hsts {
    Enable(Duration),
    IncludeSubDomains(Duration),
    Preload(Duration),
}

The HTTP Strict-Transport-Security (HSTS) header: enforces strict HTTPS usage.

HSTS tells the browser that the site should only be accessed using HTTPS instead of HTTP. HSTS prevents a variety of downgrading attacks and should always be used when TLS is enabled. Shield will turn HSTS on and issue a warning if you enable TLS without enabling HSTS when the application is run in non-debug profiles.

While HSTS is important for HTTPS security, incorrectly configured HSTS can lead to problems as you are disallowing access to non-HTTPS enabled parts of your site. Yelp engineering has good discussion of potential challenges that can arise and how to roll this out in a large scale setting. So, if you use TLS, use HSTS, but roll it out with care.

Variants

Enable(Duration)

Browser should only permit this site to be accesses by HTTPS for the next Duration.

IncludeSubDomains(Duration)

Like Hsts::Enable, but also apply to all of the site’s subdomains.

Preload(Duration)

Send a “preload” HSTS header, which requests inclusion in the HSTS preload list. This variant implies Hsts::IncludeSubDomains, which implies Hsts::Enable.

The provided Duration must be at least 365 days. If the duration provided is less than 365 days, the header will be written out with a max-age of 365 days.

Details

Google maintains an HSTS preload service that can be used to prevent the browser from ever connecting to your site over an insecure connection. Read more at MDN. Don’t enable this before you have registered your site and you ensure that it meets the requirements specified by the preload service.

Trait Implementations

impl Clone for Hsts

fn clone(&self) -> Hsts

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for Hsts

Defaults to Hsts::Enable(Duration::days(365)).

fn default() -> Hsts

Returns the “default value” for a type.

impl From<&Hsts> for Header<'static>

fn from(hsts: &Hsts) -> Self

Converts to this type from the input type.

impl PartialEq for Hsts

fn eq(&self, other: &Hsts) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Policy for Hsts

const NAME: &'static str = "Strict-Transport-Security"

The actual name of the HTTP header.

fn header(&self) -> Header<'static>

Returns the Header to attach to all outgoing responses.

impl Copy for Hsts

impl StructuralPartialEq for Hsts