How to fix Security Misconfiguration
in Salvo
Executive Summary
Salvo is a high-performance Rust web framework, but its flexibility is a double-edged sword. Security misconfigurations—ranging from directory listing leaks to verbose error messages and missing security headers—are common entry points for attackers. This guide covers hardening the middleware stack and static file handling to prevent information disclosure and cross-site scripting.
The Vulnerable Pattern
use salvo::prelude::*;#[tokio::main] async fn main() { let router = Router::new() .push( Router::with_path(“static/<*path>”) .get(StaticDir::new([“public”]).show_files_listing(true)) // VULNERABILITY: Directory listing enabled );
// VULNERABILITY: No security headers, no panic recovery, listening on all interfaces Server::new(TcpListener::bind("0.0.0.0:7878")).serve(router).await;
}
The Secure Implementation
The hardening process focuses on three critical areas: 1. Static Asset Protection: By setting `show_files_listing(false)`, we prevent attackers from mapping the server's file structure. 2. Information Leakage: The `CatchPanic` middleware ensures that internal Rust panics do not return raw debug information to the client. 3. Protocol Hardening: Salvo's `affix` middleware is used to manually inject security headers that mitigate common web attacks like clickjacking and MIME-type sniffing. Finally, binding to `127.0.0.1` instead of `0.0.0.0` prevents unintended exposure to the public internet during development or internal deployment.
use salvo::prelude::*; use salvo::extra::catch_panic::CatchPanic;#[tokio::main] async fn main() { let router = Router::new() // MITIGATION: Sanitize errors to prevent stack trace leaks .hoop(CatchPanic::new()) // MITIGATION: Inject essential security headers .hoop(affix::inject_header(“X-Content-Type-Options”, “nosniff”, true)) .hoop(affix::inject_header(“X-Frame-Options”, “DENY”, true)) .hoop(affix::inject_header(“Content-Security-Policy”, “default-src ‘self’”, true)) .push( Router::with_path(“static/<*path>”) .get(StaticDir::new([“public”]).show_files_listing(false)) // MITIGATION: Disable directory listing );
let service = Service::new(router); // MITIGATION: Bind to localhost for internal services or use specific interface Server::new(TcpListener::bind("127.0.0.1:7878")).serve(service).await;
}
Your Salvo API
might be exposed to Security Misconfiguration
74% of Salvo apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.