Skip to main content

origin_and_security_headers

bhtune_server::security

Function origin_and_security_headers 

Source 
pub async fn origin_and_security_headers(
    __arg0: State<AppState>,
    request: Request<Body>,
    next: Next,
) -> Response
Expand description

Reject cross-site state-changing browser requests and protect public Demo/private API responses.

Demo mode requires the exact configured Origin on every state-changing request. Full mode retains CLI/curl compatibility, accepts a browser-controlled same-origin request from the Vite development proxy, and otherwise requires the configured Origin. This middleware never emits CORS response headers.

Baseline browser protections apply to every response. Demo responses additionally receive private/no-index caching headers on every path, including the embedded SPA; Full mode receives those privacy headers on /api only so immutable static-asset caching is preserved. Full mode’s existing Scalar documentation page is the sole CSP exception because its upstream HTML loads the Scalar bundle from jsDelivr; Demo mode does not expose that page.