Axum 0.8

Apply the Rust 1.98 baseline first, including its toolchain and dependency rules. These rules cover Axum 0.8 with Tokio 1.x, Hyper 1.x, and Tower 0.5, and were checked against 0.8.9. Tower HTTP controls below apply to tower-http 0.6.11 and 0.7.1, both compatible with Axum 0.8.9. Axum declares Rust 1.80 as its minimum; verify the compiler requirements of the complete locked dependency graph.

Routing and middleware

• Register all routes, nested or merged routers, and fallbacks intended for a security boundary before calling Router::layer or Router::route_layer; routes added later do not inherit that middleware.
• Protect sensitive fallbacks explicitly. Router::route_layer skips unmatched paths; MethodRouter::route_layer skips its method fallback, including handlers installed with any. Review fallback_service, method_not_allowed_fallback, and route_service when composing routers.
• Review the actual request order: repeated Router::layer calls run the last added layer first, while ServiceBuilder runs layers in declaration order. Place response headers and diagnostics so authentication failures, extractor rejections, and limit responses receive them too.
• Wrap URI normalization or rewriting around the whole Router; layers installed with Router::layer run after route selection. Account for nest stripping the matched prefix and inheriting outer fallbacks; use OriginalUri only when policy needs the original full URI.
• Keep get handlers free of business mutations and apply their authorization to HEAD too: Axum runs the GET handler for HEAD and