Vert.x Web 5.1

Apply the Java 21 prompt first. Target Vert.x Web 5.1 on JDK 21; these rules were checked against 5.1.6. Vert.x 5 has a Java 11 baseline; its virtual-thread features require Java 21. Apply the following rules to the Web handlers and optional clients or bridges actually used.

Routing and identity

• Follow Vert.x 5's handler phases within each route: platform handlers such as SessionHandler, security-policy handlers such as CorsHandler, BodyHandler, tenant selection, authentication, input-trust handlers such as CSRFHandler, authorization, then application handlers. Keep io.vertx.web.router.setup.lenient unset or false so invalid setups fail.
• Check protection across separate routes, Route.order(...), and sub-router mounts; the per-route setup check does not prove coverage across the router. Bind business routes to explicit HTTP methods, and call RoutingContext.next() only after the current security check succeeds. Keep fallback routes from exposing protected operations.
• Keep normalized routing enabled with Route.useNormalizedPath(true) and use RoutingContext.normalizedPath() for path-based decisions. Restrict reroute(...) destinations and authorize the final operation; rerouting preserves context and some handlers skip processing when already visited.
• Establish RoutingContext.user() only from verified identity. Authentication handlers can reuse an existing context user instead of authenticating new credentials; keep session identity from satisfying routes that require a fresh bearer token or stronger authentication.
• Run