Brummel
f3d0380dbd
Attaches a SetResponseHeaderLayer stack to create_router_with_state (not main.rs) so tests observe the same response shape as production. `if_not_present` mode so per-route overrides (magic.rs already sets its own Referrer-Policy) are preserved. Sets: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Content-Security-Policy, Permissions-Policy. HSTS is deliberately omitted until TLS termination is in place — a cached max-age on a plain-HTTP deployment is irreversible. CSP uses 'unsafe-inline' for script/style since templates contain inline scripts; revisit if any user input ever renders unescaped. Removes #[ignore] from the 10 attack-confirming header tests; two regression anchors (no-HSTS, no-duplicated magic header) were already green.
39 lines
1.1 KiB
TOML
39 lines
1.1 KiB
TOML
[package]
|
|
name = "doctate-server"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
default-run = "doctate-server"
|
|
|
|
[dependencies]
|
|
doctate-common = { path = "../doctate-common" }
|
|
axum = { version = "0.8", features = ["multipart"] }
|
|
tokio.workspace = true
|
|
reqwest.workspace = true
|
|
tempfile = "3"
|
|
askama = "0.12"
|
|
tracing.workspace = true
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
tracing-appender = "0.2"
|
|
dotenvy = "0.15"
|
|
uuid.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
toml.workspace = true
|
|
tower-http = { version = "0.6", features = ["limit", "trace", "set-header"] }
|
|
tokio-stream = { version = "0.1", features = ["sync"] }
|
|
futures-util = "0.3"
|
|
rand = "0.8"
|
|
bcrypt = "0.15"
|
|
axum-extra = { version = "0.12", features = ["cookie", "form"] }
|
|
time.workspace = true
|
|
toml_edit = "0.25.11"
|
|
rpassword = "7.4.0"
|
|
pulldown-cmark = { version = "0.13", default-features = false, features = ["html"] }
|
|
strsim = "0.11"
|
|
spellbook = "0.4.0"
|
|
|
|
[dev-dependencies]
|
|
tower = { version = "0.5", features = ["util"] }
|
|
wiremock = "0.6"
|
|
filetime = "0.2"
|