Gin 1.12

Apply the Go 1.27 baseline first. These rules cover github.com/gin-gonic/gin v1.12.0 in the Gin 1.12 release line. Gin requires Go 1.25.0 or newer.

Routing and middleware

• Install an explicit security middleware stack; gin.New() installs none, and gin.Default() adds only Logger and Recovery, not authentication, authorization, CSRF protection, or rate limits.
• Call Engine.Use and RouterGroup.Use before creating protected subgroups and routes; Gin copies middleware into their handler chains at registration, so later additions do not retrofit existing routes.
• Call c.AbortWithStatus or c.AbortWithStatusJSON and immediately return on rejection. Abort stops pending handlers, not the current handler or outer middleware after c.Next(); c.Error, c.JSON, and returning from middleware alone do not abort the chain.
• Read the authenticated principal with c.Get and check presence and type before authorizing the object and tenant selected by c.Param or bound input; typed getters returning zero values are not evidence of authentication.
• Register only required methods instead of Any, which includes CONNECT and TRACE. Apply access controls to static and administrative routes and to sensitive NoRoute or NoMethod fallback handlers independently of protected groups.
• Keep proxy, authorization, and handler path interpretation consistent when configuring UseEscapedPath, UseRawPath, UnescapePathValues, and RemoveExtraSlash; UseEscapedPath overrides UseRawPath. Do not decode an authorized parameter again before using it.
• Enforce host