CSP

RuniqueApp::builder(config)
    .middleware(|m| {
        m.with_csp(|c| {
            c.policy(SecurityPolicy::strict())
             .with_upgrade_insecure(!is_debug())  // CSP directive upgrade-insecure-requests
             .images(vec!["'self'", "data:"])    // Allow data: for images
        })
    })

// X-Frame-Options, X-Content-Type-Options, Referrer-Policy... are always sent.

// Strict: no 'unsafe-inline', upgrade-insecure-requests on
SecurityPolicy::strict()

// Permissive: for local development only
SecurityPolicy::permissive()

// Generated header (strict):
// Content-Security-Policy:
//   default-src 'none';
//   script-src 'self' 'nonce-abc123';
//   style-src 'self';
//   img-src 'self';
//   font-src 'self';
//   connect-src 'self';
//   object-src 'none';
//   frame-ancestors 'none';
//   base-uri 'self';
//   form-action 'self';
//   upgrade-insecure-requests

{# The nonce is regenerated on every request.
   It is automatically injected into the CSP header. #}
<script nonce="{{ csp_nonce }}">
    // This inline script is allowed by CSP
    document.querySelector('form').addEventListener('submit', ...);
</script>