Encryption, CORS, headers, rate limiting
Encryption
Section titled “Encryption”Set app.key to a base64:… value (Encrypter.generateKey()). Then:
encrypter.encryptString("secret")encrypter.decryptString(payload)Uses AES-256-GCM.
CorsMiddleware(CorsConfig(…)) handles preflight OPTIONS and applies allow-origin/methods/headers.
Security headers
Section titled “Security headers”SecurityHeadersMiddleware adds configurable browser security headers.
Rate limiting
Section titled “Rate limiting”rateLimiter.forName("api") { RateLimit(60, 60) }rateLimiter.attempt(key, maxAttempts, decaySeconds)ThrottleRequests middleware returns 429 with Retry-After when a named limiter is exceeded.