Security Operations Deployment

Security Operations & Deployment

When to Apply Each Middleware - Decision Guide

withRateLimit() - Apply to:

✅ Always apply to:

• Any route that could be abused (spam, brute force)
• Login-like operations (even if Clerk handles auth)
• Data creation/modification endpoints
• Contact/support form endpoints
• Webhooks (to prevent DoS)
• File upload endpoints
• Search endpoints
• Data export endpoints
• Any expensive AI/API operations
• Report generation
• Bulk operations

❌ Usually not needed for:

• Static asset requests (handled by CDN)
• Simple GET endpoints that only read public data
• Health check endpoints
• Endpoints already protected by authentication rate limits

withCsrf() - Apply to:

✅ Always apply to:

• All POST/PUT/DELETE operations
• Any state-changing operation
• Form submissions
• Account modifications
• Payment operations
• Data deletion operations

❌ Skip for:

• GET requests (read-only operations)
• Public read-only endpoints
• Webhooks (use signature verification instead)

Combining Both Middlewares