Middleware & Security

Runique includes configurable security middlewares automatically applied in the optimal order through the slot system.

Module	Description
CSRF Protection	Token, Double Submit Cookie, AJAX
Content Security Policy	Nonce, profiles, headers
Sessions	Store, durations, access in handlers
Hosts & Cache	Allowed Hosts, Cache-Control, security headers
Builder & Configuration	Classic Builder, Intelligent Builder, environment variables
Rate Limiting	Per-IP, per-route rate limiting, configurable
Login Required	Route protection — redirects if not authenticated
CORS	Cross-Origin Resource Sharing — origins, credentials, preflight
Trusted Proxies	Real client IP, RFC 1918, CIDR, `ClientIp`
Permissions-Policy	Browser API restrictions via HTTP header
Open Redirect	Automatic blocking of redirects to external origins
Anti-Bot Honeypot	Invisible trap field — automatic bot rejection

Execution Stack

Incoming request
    ↓
slot  0  Extensions          → Inject Engine, Tera, Config (always active)
slot  2  TrustedProxies      → Real client IP from X-Forwarded-For (always active)
slot  5  Compression         → Response compression (always active)
slot  8  CORS                → Cross-Origin Resource Sharing (if with_cors() configured)
slot 10  ErrorHandler        → Capture and render errors (always active)
slot 15  HostValidation      → Allowed host validation (if with_allowed_hosts() configured)
slot 17  HttpsRedirect       → HTTPS redirect behind a proxy (if ENFORCE_HTTPS, never with ACME)
slot 20+ Custom              → Your custom middlewares
slot 25  OpenRedirect        → Block external redirects (always active)
slot 30  SecurityHeaders     → CSP (with nonce), X-Frame-Options, HSTS, Permissions-Policy… (always active)
slot 40  Cache               → No-cache in development (conditional, on by default)
slot 50  Session             → Session management (always active)
slot 55  SessionUpgrade      → Upgrade anonymous session → authenticated (always active)
slot 57  Auth                → Load CurrentUser from session (always active)
slot 60  CSRF                → Cross-Site Request Forgery protection (always active)
slot 65  AntiBotHoneypot     → Invisible trap field, force_invalid on fill (if with_anti_bot() configured)
    ↓
Handler (your code)

"Always active" slots apply to every request with no extra configuration. Others only insert into the stack when their builder method is called.

CSP: slot 30 (SecurityHeaders) emits the CSP header unconditionally, with its nonce. .with_csp(...) customizes the default policy, it doesn't turn it on.