[{"data":1,"prerenderedAt":127},["ShallowReactive",2],{"docs-\u002Fdocs\u002Fmain\u002Fsecurity":3},{"id":4,"title":5,"body":6,"description":114,"extension":115,"group":116,"meta":117,"navigation":118,"order":119,"path":120,"section":121,"seo":122,"source":123,"stem":124,"version":125,"__hash__":126},"docs\u002Fdocs\u002Fmain\u002Fsecurity.md","Security configuration",{"type":7,"value":8,"toc":104},"minimark",[9,14,31,35,42,46,57,61,68,72,89,93],[10,11,13],"h2",{"id":12},"authentication-and-authorization","Authentication and authorization",[15,16,17,18,22,23,26,27,30],"p",{},"Authentication is application-owned. ",[19,20,21],"code",{},"security.Authenticate(verifier)"," delegates credential extraction and verification, requires a nonempty subject and returns a generic 401 on failure. ",[19,24,25],{},"security.Current(ctx)"," reads the principal. ",[19,28,29],{},"security.Authorize(predicate)"," returns 403 for a rejected authenticated principal. Install authentication before authorization. Declare matching endpoint error statuses and OpenAPI security schemes; metadata alone does not enforce authentication. No JWT\u002Fsession scheme is assumed.",[10,32,34],{"id":33},"cors-policy","CORS policy",[15,36,37,38,41],{},"No CORS middleware is enabled automatically. ",[19,39,40],{},"security.CORS"," accepts explicit HTTP(S) origins, methods and header allowlists, validates configuration and denies unknown origins\u002Fpreflights. Wildcards are rejected. Credentials are opt-in; preflight caching is limited to 24 hours. CORS does not replace authentication or CSRF defenses for cookie-based applications.",[10,43,45],{"id":44},"request-limits-and-deadlines","Request limits and deadlines",[15,47,48,49,52,53,56],{},"Typed bodies default to 1 MiB and reject unknown fields, duplicate keys, trailing JSON, incorrect field case and null nonnullable values. Parameter duplicates and nonfinite floats are rejected. Use pointer DTO fields for optional\u002Fpresence-sensitive values and pointer nested input objects. Set ",[19,50,51],{},"MaxBodyBytes"," for an endpoint and ",[19,54,55],{},"http.Deadline"," for cooperative request deadlines. Server defaults are read 10s, write 30s, idle 60s and shutdown 10s. Configure ingress and application budgets together.",[10,58,60],{"id":59},"transport-security","Transport security",[15,62,63,64,67],{},"The HTTP listener is plain HTTP intended for a configured TLS ingress or private local deployment. gRPC requires TLS 1.2 or newer; loading helpers support CA verification and mTLS. Plaintext requires explicit ",[19,65,66],{},"DevelopmentInsecure","; clients reject skipped certificate verification. No automatic RPC retries are enabled. Managed clients apply a five-second default unary\u002Fstream deadline, bounded by an earlier caller deadline.",[10,69,71],{"id":70},"error-and-secret-redaction","Error and secret redaction",[15,73,74,75,78,79,82,83,88],{},"With debug disabled, internal errors, panic payloads, readiness failures and database startup credentials are redacted at framework boundaries. JSON clients retain generic internal errors even in debug mode. Browser HTML diagnostics with ",[19,76,77],{},"DEBUG=true"," can display original errors and stacks; use ",[19,80,81],{},"DEBUG=false"," on public deployments and see ",[84,85,87],"a",{"href":86},"\u002Fdocs\u002Fmain\u002Fdebug\u002F","debug mode",". Recovery does not dump request headers or panic values. Application logs, SQL logging, explicit public error messages and caller-supplied interceptors remain the application's responsibility. Trace identifiers are correlation data, never authentication credentials.",[10,90,92],{"id":91},"documentation-and-metrics-exposure","Documentation and metrics exposure",[15,94,95,96,99,100,103],{},"OpenAPI is enabled by default: set ",[19,97,98],{},"DisableOpenAPI"," when it should not be public. ",[19,101,102],{},"\u002Fdocs"," is opt-in and loads no external assets. Trusted proxies are disabled unless configured outside the framework's router. Metrics exposure is opt-in in the example. Load secrets from deployment configuration; do not commit credentials.",{"title":105,"searchDepth":106,"depth":106,"links":107},"",2,[108,109,110,111,112,113],{"id":12,"depth":106,"text":13},{"id":33,"depth":106,"text":34},{"id":44,"depth":106,"text":45},{"id":59,"depth":106,"text":60},{"id":70,"depth":106,"text":71},{"id":91,"depth":106,"text":92},"Review Gonex request limits, authentication boundaries, CORS policy and secure transport configuration.","md","SHIP YOUR APP",{},true,160,"\u002Fdocs\u002Fmain\u002Fsecurity","build",{"title":5,"description":114},"security.md","docs\u002Fmain\u002Fsecurity","main","B7IB9-upd0XnpljsGd2q_EygI0VvC_6PPVHLmDTEMvQ",1792521640631]