Security, Middlewares, CSP & Sessions

No middleware is configured through .env. In debug mode (DEBUG=true), no-cache headers are added on localhost; .middleware(|m| m.with_cache(true)) turns them off.

CSP — Configured exclusively via the builder (.with_csp(...)). See CSP. Host validation — Configured exclusively via the builder (.with_allowed_hosts(|h| h.enabled(true).host("..."))). See Host Validation.

Session memory limits and cleanup interval are configured via the builder — see Sessions.