hapi 21

Apply the Node.js 24 baseline first, including its JavaScript baseline. These rules target hapi 21 on a supported Node.js 24 patch and were checked against @hapi/hapi 21.4.10. The optional plugin rules were checked against @hapi/cookie 12.0.1, @hapi/crumb 9.0.1, @hapi/inert 7.1.2, @hapi/h2o2 10.0.4, @hapi/jwt 3.2.4, and the community hapi-rate-limit 8.0.0; each plugin has its own releases, so check the resolved plugin versions with npm ls after every hapi upgrade.

Authentication and authorization

• Register the authentication scheme or its providing plugin and configure a strategy, then call server.auth.default() before registering application routes and route-providing plugins. Audit every options.auth: false, alternative strategy, and route override; registering a strategy alone does not protect routes, and later defaults do not retrofit every previously configured route.
• Use auth.mode: 'required' for protected operations. Reserve 'optional' for routes intentionally accepting no credentials and 'try' for routes intentionally continuing after invalid credentials; check request.auth.isAuthenticated before using authenticated behavior on either kind of route.
• Have custom schemes return h.authenticated({ credentials }) only after verifying the credential. Derive identity, scope, and user/application classification from trusted verification results, never directly from request fields.
• With @hapi/jwt, keep verify an object: verify: false skips signature and claim checks even when keys is set. Give each key an explicit