Rocket 0.5

Apply the Rust 1.98 baseline first. These rules cover Rocket 0.5 core APIs and deployment, and were checked against 0.5.1. Rocket declares Rust 1.64 as its minimum compiler version; the resolved dependency graph may require a newer compiler. Nightly Rust is not required.

Features and HTTP exposure

• Enable only required Rocket features: secrets, json, tls, and mtls are opt-in; http2 is enabled by default. Review separately versioned template, database, and WebSocket crates independently; rocket_contrib is incompatible with Rocket 0.5.
• Address unbounded empty HTTP/2 DATA frames in the Hyper 0.14 / h2 0.3 dependency stack before deployment. The published h2 fix in 0.4.16 does not satisfy Hyper 0.14's dependency. Prefer a patched edge proxy with HTTP/1.1 to Rocket and default-features = false; verify with cargo tree -e features that another dependency has not re-enabled hyper/http2. If retaining backend HTTP/2, require a proxy that enforces empty DATA frame limits and prevent direct access.
• Place public deployments behind a proxy or load balancer that bounds connections, request rates, headers, body transfer time, and total request time. Rocket's data limits and keep_alive timeout do not provide these protections by themselves; do not use the obsolete read_timeout or write_timeout keys as controls.

Routes, guards, and authorization

• Require a FromRequest authentication guard on every protected handler, including alternate mounts, formats, and methods. A successfully parsed FromParam identifier or Json<T> value does not authorize