Security is most effective when important boundaries are represented in framework behavior instead of scattered across application conventions. Jeston provides primitives that help applications make those boundaries explicit while leaving policy decisions to the team.
JSON request bodies are bounded by limits.bodyBytes, malformed JSON returns HTTP 400, and oversized bodies return 413. The platform layer includes contracts for sessions, CSRF, authorization, and rate limiting. Applications still define identity lifecycle, permissions, abuse thresholds, and data handling.
Applications can opt into the nonce-based security preset with security: { trustedTypes: true }, and a CSP nonce can be supplied through security.cspNonce when nonce-bearing scripts are rendered. Plugin extensions must declare their permissions before setup.
Jeston does not eliminate threat modeling, secret management, dependency review, authorization tests, or incident response. Its value is that request limits, origin checks, typed authorization boundaries, and explicit extension permissions provide stable places to apply those practices.
Review the security and runtime material in github.com/kvantjs/jeston.
Top comments (0)