Redirects, headers and protection

Redirects, rewrites, security headers, CORS, password-protected pages and IP or country limits, without app code.

A project's routing.json is applied in front of the app:

Redirects (permanent or temporary) and rewrites to another path or service;
response headers, such as security headers;
CORS rules for APIs;
password-protected paths, for a staff page;
allow lists by IP address or country;
custom error pages.

Paths use :name for one segment and :name* for the rest (/blog/:slug, /docs/:path*). Your AI edits it with its routing tool, which checks the whole file before it takes effect.