Connect for Go 2

Apply the Go 1.27 baseline first. These rules cover connectrpc.com/connect/v2, including its connecthttp and connectinprocess transports and the Protobuf APIv2 runtime.

Routing, authentication, and authorization

• Register only intended procedures on connect.NewServer; review every generated Register...Handler call before connecthttp.Mount. Treat separately mounted health, reflection, and administrative handlers as separate authorization surfaces.
• Authenticate protected RPCs in a connect.ServerInterceptor before calling next. Get the CallInfo with connect.CallInfoForServerContext(ctx), read its RequestHeader(), and verify the credentials; a nonempty header or CallInfo.PeerAddr is not an identity. A v2 server interceptor runs before request decompression and decoding.
• Authorize spec.Procedure and the requested resource for the current principal. For client or bidirectional streams, validate and authorize each message before its side effects; accepting the stream does not authorize later resource identifiers.
• Apply security interceptors to the connect.NewServer used by every transport. connectinprocess.New(server) runs server interceptors but bypasses HTTP middleware, CORS, TLS, and connecthttp.Mount options. Do not make HTTP-only controls the sole protection for an in-process or custom transport.
• Keep the default CodeUnimplemented fallback unless a proxy needs Server.SetUnknownHandler. If installing a fallback, reject unauthorized procedures and bound its input: unknown procedures have no schema and are treated as