# Redirects, headers and protection (https://lazyfrog.dev/docs/routing)

A project's `routing.json` is applied in front of the app:

- **Redirects** (permanent or temporary) and **rewrites** to another path or service;
- **response headers**, such as security headers;
- **CORS** rules for APIs;
- **password-protected paths**, for a staff page;
- **allow lists** by IP address or country;
- **custom error pages**.

Paths use `:name` for one segment and `:name*` for the rest (`/blog/:slug`, `/docs/:path*`). Your AI edits it with its `routing` tool, which checks the whole file before it takes effect.