How a request is served

Choose a route and follow it through middleware, a loader and the response.

Follow a request

createHandler returns an object with one method, fetch(request). The dev server, production adapters and prerendering all call this handler, so the same request checks apply to each. In order, and each step only if the earlier ones accepted the request:

1. Guards: URL longer than 8192 characters (414), unknown method (405), a Host that is not in allowedHosts (400), contradictory body framing (400), a declared body over 1 MiB (413).
2. Resolution: the health path, a server function (/_dusk/fn/<id>), an API route, or a page.
3. CSRF for every method except GET, HEAD and OPTIONS (403).
4. Middleware from entry-server.ts, outermost first. await next() resolves with the response the client will get, also when the route threw (see Middleware).
5. The route: the server function, the API handler, or the page (loaders run first, then the app renders and streams).
6. Response headers: cookies you set, secure headers, CSP for HTML, cache-control: private, no-store unless the route set one, x-request-id.

The request is also raced against a 30 second budget (504) and a body limit that applies while the body is read. createHandler lists every option; Security covers the checks.