DocsServer features
Request pipeline
Wrap matched application handlers with ordered middleware while Rahti preserves its outer transport and security boundaries.
Application middleware
A middleware receives an owned Axum request and Next. Work before next.run(request).await follows registration order; response work unwinds in reverse. The consumed continuation cannot dispatch twice.
use axum::{extract::Request, response::Response};
use rahti::request_pipeline::{Next, RequestPipeline};
async fn application_logging(request: Request, next: Next) -> Response {
let mut response = next.run(request).await;
response.headers_mut().insert(
"x-application",
"accounts".parse().unwrap(),
);
response
}
pub fn pipeline() -> RequestPipeline {
RequestPipeline::new().with(application_logging)
}Install the complete pipeline during initialize_application before building the router. The router snapshots it, so later configuration does not mutate a running application.
Exact scope
| Included | Outside the application chain |
|---|---|
| matched pages | public files and framework fallbacks |
| route.rs APIs | development and MCP endpoints |
| RPC POSTs | WebSocket conversations |
| static-export rendering | requests rejected before route application work |
Middleware may change headers, extensions, status, and bodies. Route matching has already happened, so changing the URI cannot reroute the request. Avoid consuming streaming request bodies unless you deliberately reconstruct them.
Security order
production observability
-> security headers
-> rate limiting
-> CSRF
-> route match and authentication
-> application request pipeline
-> page cache / layouts / handlerThe auth session scope is active inside application middleware, but authentication is not authorization. Apply the same named ability or resource policy when a middleware gates an application action.
Short circuits and failures
A middleware panic becomes a logged HTTP 500: RPCs receive JSON and other routes receive non-cacheable Problem Details. Production hides the diagnostic.