Behavior at the edges

The following rules apply to alternate URL spellings, fragmented messages and generated assets.

• Redirects. A target with a space at either end is refused, not trimmed, so " //host" is never sent as //host. A form post that succeeds sends the browser back to its Referer path only when that path passes the same check.
• Clerk route rules. createRouteMatcher answers for the path as written and as decoded, in lower case, because the Dusk router serves /DASHBOARD and /%64ashboard as /dashboard. Rules with several wildcards are matched in linear time. Try your rules against the paths your site serves in other spellings (upper case, percent-encoded).
• Clerk webhooks. verifyWebhook reads at most 1 MiB before it checks the signature (maxBodyBytes changes that), and refuses a larger body with reason: "body-too-large".
• WebSockets. A frame that arrives in pieces is decoded in linear time, and ping frames count against wsMaxMessagesPerSecond: a client that floods pings is closed with 1008.
• Static files. A prerendered HTML page carries the same default X-Frame-Options, Referrer-Policy and Permissions-Policy as a handler answer. Set those headers in your own proxy if you turn the defaults off.
• Image optimizer. A local source is never called with a path that contains a dot segment, an encoded dot, slash or backslash, or a control character (400). A local source must declare an image/* type (415).

What the handler does not cover, so you decide it for your app: a client can pack many calls into one batch (limit sign-in and webhook routes with a rate limiter that fits their traffic), connection caps are per process, Clerk's optional authorizedParties is off unless you set it, and the Convex deployment URL must be https.