Sanic 25.12

Apply python/python/3 first. These rules cover the Sanic 25.12 LTS line, checked against 25.12.1, on maintained Python 3.10–3.14 runtimes. Distinguish the native Sanic server from ASGI deployments and review optional extensions at their installed versions.

Version and application setup

• Keep HTTP/1.1 parsing and response serialization in Sanic's native implementation rather than a custom protocol class or serializer: in 25.12.1 the native server rejects a chunked request that carries trailer fields and closes the connection, so trailer bytes can't be reparsed as a smuggled second request, and the serializer strips CR, LF, and NUL from response header names and values.
• Load route handlers, blueprints, listeners, app.update_config() files, and configuration converters only from trusted application code; Python configuration files execute code, and automatically loaded SANIC_ environment values can change security settings.
• Decide explicitly whether to enable Sanic Extensions: AUTO_EXTEND=True automatically activates an installed sanic-ext. Set it to False when unused, and review generated documentation routes, extra HTTP methods, CORS, validation, and serializers when enabled.

Authentication, routes, and middleware

• Verify credentials before assigning an identity to request.ctx; request.token and request.credentials only extract authorization data and do not authenticate it. Reject duplicate Authorization headers, enforce the intended authentication scheme, and authorize the requested tenant, object, and operation in each protected