Fiber 3.5.0

Apply the Go 1.27 baseline first. These rules cover github.com/gofiber/fiber/v3 at 3.5.0. Use Fiber and fasthttp controls for its native HTTP stack; the baseline's net/http server settings and middleware apply only at an explicitly configured net/http boundary.

Routing and authorization

• Register authentication and authorization before protected routes, Group handlers, and mounted applications. Return immediately on failure without calling c.Next(), and restrict middleware Next skip predicates to deliberately public requests.
• Populate authentication values in c.Locals only from verified credentials, using private typed keys. Authorize the final tenant and object selected through c.Params, binding, or storage; group membership and route constraints do not grant access.
• Check authorization across automatically registered HEAD routes, manual overrides, All, wildcards, and fallbacks. Align checks with CaseSensitive, StrictRouting, and UnescapePath; a failed route constraint can select another matching route.
• Keep SkipUnmatchedRoutes disabled when global logging or throttling must cover unregistered paths. Enabling it returns early 404/405 responses before middleware, except for CORS preflight requests.
• Supply pre-hashed passwords to basicauth.Config.Users, choosing bcrypt for password storage. Make custom basicauth.Config.Authorizer and keyauth.Config.Validator callbacks fail closed, and retain the header-based KeyAuth extractor instead of accepting API keys from URLs.

Binding and request limits

• Choose explicit