Security
What the request handler does with no configuration, how to configure headers, CSP, CSRF, cookies, sessions, rate limits and hosts, and a production checklist.
Configure the hosts your app accepts, keep cross-site request protection enabled, and choose limits that fit legitimate traffic. This guide covers response headers, sessions, credentials and the request checks that run before application code.
Start with Secure by default.