Vert.x Web 5.2

Apply the Java 21 prompt first. Target Vert.x Web 5.2 on JDK 21; these rules were checked against 5.2.2. Vert.x 5 supports Java 11 as its minimum, while virtual-thread features need Java 21. Apply optional Web Client, SockJS, and other module rules when those components are used.

Routing and request trust

• Put SessionHandler, CorsHandler, and BodyHandler in their required platform phases, then tenant selection and authentication, CSRFHandler, AuthorizationHandler, and business handlers in the security and application phases. Keep io.vertx.web.router.setup.lenient disabled so invalid per-route ordering fails startup; inspect ordering across separate routes, Route.order(...), and mounted sub-routers too.
• Match protected routes on explicit methods and paths. Call RoutingContext.next() only after the current check succeeds, and terminate failures without passing to a weaker fallback route. Keep path normalization enabled and use RoutingContext.normalizedPath() for authorization and file mapping instead of the raw request path.
• Treat RoutingContext.reroute(...) as a new operation to authorize: it retains context, can change the method, and visited handlers such as body and CSRF handlers may not run again. Keep HttpMethod.QUERY read-only; it accepts a body in this line, but CSRFHandler does not validate QUERY, so reject it for cookie-authenticated mutations.
• Validate route parameters and parsed bodies before domain use. Route.consumes(...) and an OpenAPI route match constrain media type or shape, not ownership or authorization. Reject