fix: keep checked-in examples secure by default

examples/quick-start-lambda/README.md

@@ -43,6 +43,8 @@ src/
 
 `TestAuthProvider` can be replaced with Clerk, Auth0, or custom auth without changing `UserController` or `UserService`. The in-memory metering setup can be replaced with provider-backed storage without changing the controller or domain service. `createApp().lambdaHandler()` is the transport boundary for Lambda; the protocol and domain code remain transport-neutral.
 
+The HTTP bootstrap uses security headers, an explicit CORS origin, a 1 MB body limit, and an in-memory sliding-window rate limiter. These middlewares satisfy Croco's default security validation without cloud credentials. Disabling security validation is reserved for temporary local migration or test fixtures, not the normal example path.
+
 ## Run Locally
 
 ```bash

examples/quick-start-lambda/package.json

@@ -12,6 +12,7 @@
     "@croco/framework-context": "workspace:*",
     "@croco/metering-core": "workspace:*",
     "@croco/protocols-rest": "workspace:*",
+    "@croco/ratelimit-core": "workspace:*",
     "@croco/telemetry-sdk-node": "workspace:*",
     "@croco/transports-http": "workspace:*",
     "reflect-metadata": "^0.2.2"

examples/quick-start-lambda/src/app/bootstrap.ts

@@ -1,14 +1,32 @@
 import { AUTH_PROVIDER_TOKEN, AuthGuard } from "@croco/auth-core";
-import { Container, type ILogger, LOGGER_TOKEN } from "@croco/framework-context";
+import { Container, LOGGER_TOKEN } from "@croco/framework-context";
 import { setMeteringService } from "@croco/metering-core";
-import { createApp } from "@croco/transports-http";
+import {
+  createSlidingWindowPolicy,
+  RateLimiter,
+  RateLimitKeyBuilder,
+  SlidingWindowInMemoryStore,
+} from "@croco/ratelimit-core";
+import {
+  bodyLimitMiddleware,
+  corsMiddleware,
+  createApp,
+  createRuntimeAwareRateLimitClientIdentityPolicy,
+  mb,
+  rateLimitHttpMiddleware,
+  securityHeadersMiddleware,
+} from "@croco/transports-http";
 import { createMeteringService } from "../integrations/inMemoryMetering";
 import { TestAuthProvider } from "../integrations/TestAuthProvider";
 import { HealthController } from "../protocols/HealthController";
 import { UserController } from "../protocols/UserController";
+import type { ILogger } from "@croco/framework-context";
+import type { MiddlewareFunction } from "@croco/transports-http";
 
 type LambdaExampleApp = ReturnType<typeof createApp>;
 
+const RATE_LIMIT_BYPASS_PATHS = new Set(["/api/health"]);
+
 const demoLogger: ILogger = {
   debug: (message, context) => {
     if (context === undefined) {
@@ -46,7 +64,26 @@ export function createLambdaExampleApp(): LambdaExampleApp {
 
   return createApp({
     controllers: [HealthController, UserController],
-    securityValidation: "off",
+    middlewares: [
+      securityHeadersMiddleware(),
+      corsMiddleware({ origins: [process.env.WEB_ORIGIN ?? "http://localhost:5173"] }),
+      bodyLimitMiddleware({ limit: mb(1) }),
+      createApiRateLimitMiddleware(),
+    ],
+  });
+}
+
+function createApiRateLimitMiddleware(): MiddlewareFunction {
+  const rateLimiter = new RateLimiter(
+    new SlidingWindowInMemoryStore(),
+    new RateLimitKeyBuilder(["ip"]),
+  );
+
+  return rateLimitHttpMiddleware({
+    rateLimiter,
+    policy: createSlidingWindowPolicy("api", 100, 60_000),
+    clientIdentity: createRuntimeAwareRateLimitClientIdentityPolicy(),
+    skip: (ctx) => RATE_LIMIT_BYPASS_PATHS.has(ctx.req.path),
   });
 }
 

examples/saas-billing-golden-path/README.md

@@ -24,6 +24,8 @@ after-commit audit entry.
 
 Failure states: invalid checkout input returns `golden-path/checkout-validation`; terminal card decline returns `golden-path/payment-declined` without retrying or persisting an order; missing orders return `golden-path/order-not-found`.
 
+The HTTP bootstrap uses security headers, an explicit CORS origin, a 1 MB body limit, and an in-memory sliding-window rate limiter. These middlewares satisfy Croco's default security validation without external credentials. Disabling security validation is reserved for temporary local migration or test fixtures, not the normal example path.
+
 ## Run Locally
 
 From the repository root:

examples/saas-billing-golden-path/package.json

@@ -15,6 +15,7 @@
     "@croco/framework-context": "workspace:*",
     "@croco/problems-core": "workspace:*",
     "@croco/protocols-rest": "workspace:*",
+    "@croco/ratelimit-core": "workspace:*",
     "@croco/retry-core": "workspace:*",
     "@croco/telemetry-api": "workspace:*",
     "@croco/transports-http": "workspace:*",

examples/saas-billing-golden-path/src/app/bootstrap.ts

@@ -1,7 +1,21 @@
 import { EventBusConfig } from "@croco/events-core";
 import { InMemoryEventBus } from "@croco/events-inmemory";
-import { Container, type ILogger, LOGGER_TOKEN } from "@croco/framework-context";
-import { createApp, type CrocoApp } from "@croco/transports-http";
+import { Container, LOGGER_TOKEN } from "@croco/framework-context";
+import {
+  createSlidingWindowPolicy,
+  RateLimiter,
+  RateLimitKeyBuilder,
+  SlidingWindowInMemoryStore,
+} from "@croco/ratelimit-core";
+import {
+  bodyLimitMiddleware,
+  corsMiddleware,
+  createApp,
+  createRuntimeAwareRateLimitClientIdentityPolicy,
+  mb,
+  rateLimitHttpMiddleware,
+  securityHeadersMiddleware,
+} from "@croco/transports-http";
 import { TxManager, TxManagerRegistry } from "@croco/tx-core";
 import { CheckoutService } from "../domain/CheckoutService";
 import { InMemoryOrderRepository, ORDER_REPOSITORY_TOKEN } from "../domain/InMemoryOrderRepository";
@@ -14,6 +28,8 @@ import {
   ScriptedPaymentGateway,
 } from "../integrations/ScriptedPaymentGateway";
 import { BillingController } from "../protocols/BillingController";
+import type { ILogger } from "@croco/framework-context";
+import type { CrocoApp, MiddlewareFunction } from "@croco/transports-http";
 
 export type GoldenPathRuntime = {
   readonly app: CrocoApp;
@@ -65,7 +81,12 @@ export async function createGoldenPathRuntime(): Promise<GoldenPathRuntime> {
 
   const app = createApp({
     controllers: [BillingController],
-    securityValidation: "off",
+    middlewares: [
+      securityHeadersMiddleware(),
+      corsMiddleware({ origins: [process.env.WEB_ORIGIN ?? "http://localhost:5173"] }),
+      bodyLimitMiddleware({ limit: mb(1) }),
+      createApiRateLimitMiddleware(),
+    ],
   });
 
   return {
@@ -82,6 +103,19 @@ export async function createGoldenPathRuntime(): Promise<GoldenPathRuntime> {
   };
 }
 
+function createApiRateLimitMiddleware(): MiddlewareFunction {
+  const rateLimiter = new RateLimiter(
+    new SlidingWindowInMemoryStore(),
+    new RateLimitKeyBuilder(["ip"]),
+  );
+
+  return rateLimitHttpMiddleware({
+    rateLimiter,
+    policy: createSlidingWindowPolicy("api", 100, 60_000),
+    clientIdentity: createRuntimeAwareRateLimitClientIdentityPolicy(),
+  });
+}
+
 export function startLocalServer(app: CrocoApp): void {
   const port = parseLocalPort(process.env.PORT);
   if (port === undefined) {