Complete limits example
import { Volt, secureHeaders, timeout } from 'voltts';
const app = new Volt({ development: false, maxRequestBodySize: 1024 * 1024 });
app.use(secureHeaders());
app.use(timeout(5000));
app.post('/echo', (c) => c.json(c.body));
if (globalThis._importMeta_.main) app.listen(3000);
export default app;What each control does
maxRequestBodySize configures Bun's incoming body limit. secureHeaders adds headers such as X-Content-Type-Options and a default Content-Security-Policy. timeout(5000) returns 504 after the deadline, but does not cancel an ongoing database query or external request. Propagate cancellation to those operations yourself.
Authentication and state
Use JWT Authentication to verify credentials per request. CORS does not grant API authorization, and a rate limiter is not a complete abuse-prevention system. Do not store the authenticated user in c.store because the current application store is shared. Use local variables and service instances that are safe to share.
Browser access
Read the CORS guide before enabling browser credentials. The current CORS implementation can reflect a rejected origin when credentials is true, so enforce a credentialed origin policy in a trusted upstream or custom middleware until that behavior is corrected. Cookie authentication also needs CSRF protection appropriate to your application.