title: Secure Configuration
description: Hardening guide for running JustAPI securely in production — a high-performance FastAPI alternative built in Rust.
keywords: secure configuration, production hardening, FastAPI alternative, Rust web framework, security guide

Security Headers

Enable secure headers explicitly (not automatic):

app.enable_secure_headers(with_hsts=True)

Headers added:

• Strict-Transport-Security: max-age=31536000 (with includeSubDomains)
• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Content-Security-Policy: default-src 'self'
• X-XSS-Protection: 0
• Referrer-Policy: no-referrer

CORS Configuration

CORS is deny-by-default. Configure explicitly:

app.add_cors(
    allow_origins=["https://app.example.com"],  # Never use ["*"] in production
    allow_methods=["GET", "POST", "PUT", "DELETE"],
    allow_headers=["Authorization", "Content-Type"],
    allow_credentials=True,
)

Rate Limiting

# Global rate limit
app.enable_rate_limiter(max_requests=1000, window_seconds=60)

# Per-IP rate limit
app.enable_ip_rate_limiter(max_requests=100, window_seconds=60)

Request Body Size

app.run("0.0.0.0:8000", max_body_size=1024 * 1024)  # 1 MiB

Secrets Management

# Never hardcode secrets
# Use environment variables:
import os
DATABASE_URL = os.environ["DATABASE_URL"]
JWT_SECRET = os.environ["JWT_SECRET"]

TLS Configuration

Recommended: terminate TLS at the edge proxy. If using native TLS:

# Server configured with rustls (TLS 1.2/1.3 only)
app.run_tls(
    "0.0.0.0:8443",
    cert_path="/etc/certs/cert.pem",
    key_path="/etc/certs/key.pem",
)

Security Checklist

• Secure headers enabled
• CORS restricted to specific origins
• Rate limiting configured
• Body size limits set
• TLS termination configured (proxy or native)
• Secrets in environment variables, not code
• CI/CD: cargo audit, cargo deny passing
• Logging: no PII in request bodies
• Non-root user in Docker
• Regular dependency updates via Dependabot

See Also

• Security Policy — Vulnerability reporting
• OWASP Compliance — Compliance checklist
• Penetration Testing — Pentest guidelines