review fixes

wojcik91 · wojcik91 · commit af8754e258d7 · 2026-04-23T08:15:44.000+02:00
diff --git a/src/config.rs b/src/config.rs
@@ -28,6 +28,14 @@ fn default_adoption_timeout() -> u64 {
     10
 }
 
+fn default_rate_limit_per_second() -> u64 {
+    10
+}
+
+fn default_rate_limit_burst() -> u32 {
+    100
+}
+
 #[derive(Parser, Debug, Deserialize, Clone)]
 #[command(version)]
 pub struct EnvConfig {
@@ -51,11 +59,11 @@ pub struct EnvConfig {
     pub log_level: LevelFilter,
 
     #[arg(long, env = "DEFGUARD_PROXY_RATELIMIT_PERSECOND", default_value_t = 10)]
-    #[serde(default)]
+    #[serde(default = "default_rate_limit_per_second")]
     pub rate_limit_per_second: u64,
 
     #[arg(long, env = "DEFGUARD_PROXY_RATELIMIT_BURST", default_value_t = 100)]
-    #[serde(default)]
+    #[serde(default = "default_rate_limit_burst")]
     pub rate_limit_burst: u32,
 
     /// Configuration file path
diff --git a/src/http.rs b/src/http.rs
@@ -249,7 +249,7 @@ async fn security_headers_middleware(
     if tls {
         headers.insert(
             header::STRICT_TRANSPORT_SECURITY,
-            HeaderValue::from_static("max-age=31536000; includeSubDomains"),
+            HeaderValue::from_static("max-age=31536000"),
         );
     }
 
@@ -557,6 +557,9 @@ pub async fn run_server(
     };
 
     // Build axum app
+    // Capture a clone for security_headers_middleware which must be applied *outside*
+    // TimeoutLayer so that 408 timeout responses also carry the security headers.
+    let security_headers_state = shared_state.clone();
     let mut app = Router::new()
         .route("/", get(index))
         .route("/{*path}", get(index))
@@ -579,20 +582,22 @@ pub async fn run_server(
             shared_state.clone(),
             ensure_configured,
         ))
-        .layer(middleware::from_fn_with_state(
-            shared_state.clone(),
-            security_headers_middleware,
-        ))
         .layer(middleware::from_fn_with_state(
             shared_state.clone(),
             core_version_middleware,
         ))
-        .layer(DefguardVersionLayer::new(Version::parse(VERSION)?))
         .layer(TimeoutLayer::with_status_code(
             StatusCode::REQUEST_TIMEOUT,
             REQUEST_TIMEOUT,
         ))
         .with_state(shared_state)
+        // security_headers_middleware and DefguardVersionLayer are applied outside
+        // TimeoutLayer so that 408 responses also receive security headers.
+        .layer(middleware::from_fn_with_state(
+            security_headers_state,
+            security_headers_middleware,
+        ))
+        .layer(DefguardVersionLayer::new(Version::parse(VERSION)?))
         .layer(
             TraceLayer::new_for_http()
                 .make_span_with(|request: &Request<Body>| {
