Umbral Security

The security features you forget to add are the ones that bite you. Umbral Security ships them on by default — CSRF protection on every POST, HSTS, clickjacking headers, and template auto-escaping — so a fresh app is hardened before you write a line of security code. When a default is genuinely too tight (a JSON API that authenticates by bearer token, say), the escape hatches are explicit and narrow, not a global off switch.

Install

cargo add umbral-security

Wire it up

The defaults need no configuration — just mount it.

use umbral::prelude::*;
use umbral_security::SecurityPlugin;

let app = App::builder()
    .database("default", pool)
    .plugin(SecurityPlugin::new())
    .build()?;

Target: exempt a token-authed API from CSRF

CSRF protects cookie-authenticated form posts; a bearer-token API doesn't need it. Exempt the prefix without weakening the rest of the site.

use umbral_security::{SecurityPlugin, SecurityConfig};

SecurityPlugin::with_config(SecurityConfig {
    csrf_exempt_paths: vec!["/api".into()],
    ..Default::default()
})
.with_hsts(true);

What you get

• Double-submit CSRF token enforced on every POST
• HSTS + a full set of secure response headers
• Clickjacking protection (X-Frame-Options / frame-ancestors)
• Template output auto-escaped by default; opt out explicitly
• Per-path escape hatches instead of a global kill switch