Middleware / 14-stage hook chain (CSRF, headers, guards)

Generated from pattern-library/registry.json — do not edit by hand; change the registry and run bun run patterns:build.

Index card — the docs below are the canonical explanation; deep-tier pattern pages additionally carry invariants and emulation notes.

Category: Architecture & Request Pipeline · Tier: light · Maturity: proven (verified 2026-08-20 @ 1a130d67) · Risk: low — structural pattern, no external services

Describes the ordered SvelteKit hook chain in src/hooks.server.ts — security headers, i18n, auth, CSRF, session, consent, and guards — as the single source of truth for request interception.

When to use: Reach for it when adding or reordering cross-cutting request handling such as auth, CSRF, or security headers.

Docs

• docs/blueprint/middleware.md (GitHub · GitLab)

Code

• src/hooks.server.ts (GitHub · GitLab)
• src/lib/server/security/ (GitHub · GitLab)

Tests

• src/lib/server/security/handle-chain.gate.test.ts — Pins middleware presence and load-bearing order (GitHub · GitLab)

Machine-readable record: architecture-middleware in pattern-library/registry.json.