Fiber 3.6

Apply these rules to Fiber 3.6 handlers, middleware, clients, and deployment configuration. Also apply the included Go prompt for password storage, injection-safe queries, token verification, log neutralization, and generic SSRF controls. Fiber uses fasthttp for its server, proxy, and client paths; net/http server and transport settings do not configure those paths.

Routing and request authority

• Register authentication and authorization middleware before every protected route. Use matches prefixes in declaration order, All accepts every configured method, and Next predicates bypass middleware; review groups, mounts, domain routes, fallthrough, and every skip condition against the route table.
• Authorize the current principal, operation, tenant, and object inside the matched handler as well as at route entry. If middleware uses c.Endpoint() for route policy, deny or handle its nil result on 404 and 405 paths, and protect routes whose registration or name can change.
• Keep GET, HEAD, OPTIONS, TRACE, and QUERY free of state changes. Fiber automatically creates a HEAD route for each GET route unless disabled, and both CSRF modes treat different sets of methods as safe; do not rely on a method name alone to protect a mutating handler.
• Define one canonical interpretation of path, host, method, and client IP for authorization and routing. Review UnescapePath, CaseSensitive, StrictRouting, rewrites, custom method handling, and routes mounted under a domain. Check access control on encoded and rewritten paths and on generated HEAD