Chi 5.3

Apply the Go net/http 1.27 prompt first. Use these rules for the Chi 5.3 line of github.com/go-chi/chi/v5 on Go 1.27; they were checked against 5.3.2. Use Chi's routing semantics for Chi endpoints; the baseline's http.ServeMux pattern and unescaping behavior do not automatically apply. Chi supplies no default authentication, sessions, CSRF protection, or server timeouts.

Router construction and middleware coverage

• Configure chi.NewRouter, routes, middleware, and any chi.RegisterMethod calls before serving requests. Complete Use before registering routes or calling With on the same non-inline mux; later Use calls panic.
• Install shared security controls on the parent router and add endpoint policy through With, Group, or a subrouter's Use. Route-local middleware runs only after a match; do not assume it protects NotFound, MethodNotAllowed, or sibling routes.
• Wrap the router externally when a control must run even with no routes registered; an empty mux can call its 404 handler without executing its Use stack. Preserve required headers and logging on custom fallback responses, and supply an accurate Allow header when replacing Chi's default 405 handler.
• Prefer Get, Post, and Method registrations with deliberate method coverage. An unqualified Handle or HandleFunc accepts every supported method, including QUERY, CONNECT, and TRACE; inspect catch-all handlers and custom methods for unintended exposure.
• Protect a mounted handler at its Mount boundary. Chi advances RouteContext.RoutePath for subrouting but does not