Litestar 2

Apply the Python 3 prompt first. These rules cover Litestar 2 and were checked against 2.24.0, whose package metadata permits Python >=3.8,<4.0 and whose release CI covers 3.8–3.14; deploy on a maintained Python version covered by the Python baseline.

Authentication and route authorization

• Install the chosen SessionAuth, JWTAuth, or JWTCookieAuth configuration through on_app_init=[auth.on_app_init]. If installing auth.middleware manually on a router or controller, also attach the guards and dependencies the policy requires; the middleware property alone does not install the complete security configuration.
• Restrict authentication exclude patterns to intentional public routes with explicit anchors and path boundaries. Review exclude_from_auth, custom exclude_opt_key values, inherited route opt settings, and middleware scopes as policy exceptions, including mounted applications and static-file routes.
• Set exclude_http_methods explicitly on security configurations. SessionAuth, JWTAuth, and JWTCookieAuth default to excluding both OPTIONS and HEAD; use only the methods intended to be public, such as ["OPTIONS"] when only preflight is exempt. The lower-level AbstractAuthenticationMiddleware defaults to excluding only OPTIONS.
• Make guards raise PermissionDeniedException or NotAuthorizedException on denial; returning False does not reject a request. Guards from application, router, controller, and handler layers accumulate. Handle intentionally public preflight requests explicitly without weakening protected methods.