Vert.x Web 4.5

Apply the Java 17 prompt first. Use these rules for Vert.x Web 4.5 and its optional Web modules on Java 17; they were checked against 4.5.33. Align every Vert.x module through the io.vertx:vertx-dependencies BOM, take Vert.x 4 maintenance releases as they ship, and plan migration before official Vert.x 4 maintenance ends in April 2027. Do not substitute Vert.x 5 defaults or Java 21 virtual-thread APIs into this baseline.

Router order and route matching

• Put authentication, authorization, and browser protections on matching routes before protected business handlers. Routes normally run in registration order; set Route.order(int) or last() before attaching handlers because changing an active route's order throws. On denial, call ctx.fail(...) or end the response and return; never call next() afterward.
• Mount sub-routers with router.route("/prefix/*").subRouter(sub) and verify protection on every mount, alternate path, and direct listener. Earlier matching parent handlers apply, but a second mount can expose the same sub-router through a different chain.
• Declare allowed HTTP methods explicitly and keep unmatched requests out of permissive catch-all handlers. Make OPTIONS handlers side-effect free: authentication handlers can pass through a preflight advertising Authorization without authenticating it. Handle expected failures through failureHandler or router.errorHandler without exposing exception details.
• Restrict RoutingContext.reroute() destinations and methods to server-defined transitions and authorize the destination. Rerouting