Middleware & Security

Runique includes configurable security middlewares automatically applied in the optimal order through the slot system.

Module	Description
CSRF Protection	Token, Double Submit Cookie, AJAX
Content Security Policy	Nonce, profiles, headers
Sessions	Store, durations, access in handlers
Hosts & Cache	Allowed Hosts, Cache-Control, security headers
Builder & Configuration	Classic Builder, Intelligent Builder, environment variables
Rate Limiting	Per-IP, per-route rate limiting, configurable
Login Required	Route protection — redirects if not authenticated
CORS	Cross-Origin Resource Sharing — origins, credentials, preflight
Trusted Proxies	Real client IP, RFC 1918, CIDR, `ClientIp`
Permissions-Policy	Browser API restrictions via HTTP header
Open Redirect	Automatic blocking of redirects to external origins

Execution Stack

Incoming request
    ↓
slot  0  Extensions          → Inject Engine, Tera, Config (always active)
slot  2  TrustedProxies      → Real client IP from X-Forwarded-For (always active)
slot  5  Compression         → Response compression (always active)
slot  8  CORS                → Cross-Origin Resource Sharing (if with_cors() configured)
slot 10  ErrorHandler        → Capture and render errors (always active)
slot 20+ Custom              → Your custom middlewares
slot 25  OpenRedirect        → Block external redirects (always active)
slot 30  SecurityHeaders     → X-Frame-Options, HSTS, Permissions-Policy… (always active)
slot 31  CSP                 → Content Security Policy (always active)
slot 40  Cache               → No-cache in development (always active)
slot 50  Session             → Session management (always active)
slot 55  SessionUpgrade      → Upgrade anonymous session → authenticated (always active)
slot 57  Auth                → Load CurrentUser from session (always active)
slot 60  CSRF                → Cross-Site Request Forgery protection (always active)
slot 70  HostValidation      → Allowed host validation (if with_allowed_hosts() configured)
    ↓
Handler (your code)

"Always active" slots apply to every request with no extra configuration. Others only insert into the stack when their builder method is called.