hapi 20

Apply these rules to hapi 20 applications alongside the included Node.js prompt. Put application policy on the routes and lifecycle points that actually handle the request; review plugin configuration separately when a companion module supplies the control.

Authentication and authorization

• Register authentication schemes and strategies before routes, set server.auth.default() for protected route groups, and audit every route with options.auth: false, mode: 'optional', or mode: 'try'. The try mode lets invalid credentials reach the handler; make the handler's anonymous policy explicit.
• Verify bearer tokens before using their claims. If using @hapi/jwt, keep verification enabled, constrain acceptable algorithms and signing keys, require the expected issuer and audience, enforce expiry and not-before checks, and build request.auth.credentials from validated claims. Jwt.token.decode() is parsing, not authentication.
• Set options.auth.access.scope and entity for protected operations. An access array grants access when any entry matches; use +scope for a required scope and !scope for an excluded scope. Authorize the actual object and tenant after canonical lookup, not only a route parameter or a dynamic scope such as user-{params.id}.
• Keep a prerequisite that checks authorization before the write or external action it protects. Nested arrays in options.pre run concurrently and sibling work continues after one fails; never put the check and protected action in the same parallel array. Keep authorization prerequisite failAction: 'error'.