Middleware & Security

Runique includes configurable security middlewares automatically applied in the optimal order through the slot system.

Module	Description
CSRF Protection	Token, Double Submit Cookie, AJAX
Content Security Policy	Nonce, profiles, headers
Sessions	Store, durations, access in handlers
Hosts & Cache	Allowed Hosts, Cache-Control, security headers
Builder & Configuration	Classic Builder, Intelligent Builder, environment variables
Rate Limiting	Per-IP, per-route rate limiting, configurable
Login Required	Route protection — redirects if not authenticated
CORS	Cross-Origin Resource Sharing — origins, credentials, preflight
Trusted Proxies	Real client IP, RFC 1918, CIDR, `ClientIp`
Permissions-Policy	Browser API restrictions via HTTP header
Open Redirect	Automatic blocking of redirects to external origins
Anti-Bot Honeypot	Invisible trap field — automatic bot rejection

Execution Stack

Incoming request
    ↓
slot  0  Extensions          → Inject Engine, Tera, Config (always active)
slot  2  TrustedProxies      → Real client IP from X-Forwarded-For (always active)
slot  5  Compression         → Response compression (always active)
slot  8  CORS                → Cross-Origin Resource Sharing (if with_cors() configured)
slot 10  ErrorHandler        → Capture and render errors (always active)
slot 15  HostValidation      → Allowed host validation (if with_allowed_hosts() configured)
slot 20+ Custom              → Your custom middlewares
slot 25  OpenRedirect        → Block external redirects (always active)
slot 30  SecurityHeaders     → X-Frame-Options, HSTS, Permissions-Policy… (always active)
slot 31  CSP                 → Content Security Policy (conditional — see note)
slot 40  Cache               → No-cache in development (conditional, on by default)
slot 50  Session             → Session management (always active)
slot 55  SessionUpgrade      → Upgrade anonymous session → authenticated (always active)
slot 57  Auth                → Load CurrentUser from session (always active)
slot 60  CSRF                → Cross-Site Request Forgery protection (always active)
slot 65  AntiBotHoneypot     → Invisible trap field, force_invalid on fill (if with_anti_bot() configured)
    ↓
Handler (your code)

"Always active" slots apply to every request with no extra configuration. Others only insert into the stack when their builder method is called.

CSP special case (slots 30/31): slot 30 (SecurityHeaders) already emits the CSP header by default, unconditionally — it's the outermost layer, so it writes the response last. Slot 31 (CSP) only inserts if enable_csp is set, but its own header gets overwritten by slot 30's right after anyway. .with_csp(...) therefore customizes the default policy rather than turning it on.