Javalin 7

Apply the Java 21 prompt first. These rules cover Javalin 7 applications using that baseline and were checked against 7.2.3; Javalin itself requires Java 17 or later and Jetty 12. The tagged build selects Jetty 12.1.12 and the EE10 servlet integration.

Routes, middleware, and policy coverage

• Register routes, filters, and exception handlers through config.routes during application creation. Review trusted plugins and any use of config.unsafe or app.unsafe, especially replacement of the servlet request lifecycle, for preservation of security handlers.
• Enforce ctx.routeRoles() in beforeMatched; roles are metadata and do not enforce access themselves. Deny unclassified endpoints, use an explicit public role where intended, and derive identity and tenant from verified credentials before checking access to the requested object.
• Stop denied requests by throwing UnauthorizedResponse or ForbiddenResponse before performing work. Setting ctx.status(...), assigning a result, or returning from a before-handler does not stop subsequent handlers; after-handlers can still run after an exception and must preserve the denial.
• Audit every ctx.skipRemainingHandlers() call because it also removes later after/error handlers. Place mandatory response headers and cleanup where short-circuiting or an already committed response cannot omit them.
• Define authorization for explicit and implicit HEAD, OPTIONS, QUERY, custom methods, and fallback resources. Register an explicit protected HEAD route when needed; an implicit HEAD response does not execute the