Surface CSRF, proxy trust, and body cap in production docs

The production checklist in deployment.rst and the putting-it-all-
together config example now mention csrf=True, trust_proxy_headers, and
the 100 MiB max_request_size default alongside the existing items.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: kennethreitz

docs/source/deployment.rst

@@ -264,6 +264,15 @@ Before going live:
   :doc:`configuration guide <guide-config>`.
 - **Disable debug mode** — it's off by default; never set ``debug=True`` in production
 - **Set allowed hosts** — ``allowed_hosts=[...]``, restricted to your domains
+- **Behind a proxy? Trust its headers** — ``trust_proxy_headers=True`` so
+  HTTPS detection, redirects, and client IPs reflect the original request
+  (only when *every* request comes through your proxy — see `Reverse Proxy`_)
+- **Serving browser forms? Enable CSRF protection** — ``csrf=True`` pairs
+  with the default-on cookie sessions; exempt webhook routes with
+  ``csrf=False``. Token-only APIs (no cookies) don't need it.
+- **Check the request-body cap fits** — bodies over ``max_request_size``
+  (100 MiB by default) get a ``413``; raise it for large uploads (multipart
+  streams to disk, so a bigger cap doesn't mean more memory)
 - **Use multiple workers** — ``--workers 4`` or more, depending on CPU cores
   (set a stable secret key first — see above)
 - **Add a health check** — ``/health`` endpoint for monitoring

docs/source/guide-config.rst

@@ -242,6 +242,12 @@ A production-ready configuration setup::
         # secret_key is read from RESPONDER_SECRET_KEY automatically
         debug=os.getenv("DEBUG", "false") == "true",
         allowed_hosts=os.getenv("ALLOWED_HOSTS", "*").split(","),
+        # Serving browser forms? Require a session-bound CSRF token on
+        # unsafe requests (see the tour's CSRF Protection section).
+        csrf=True,
+        # Behind nginx/Caddy/a load balancer, honor its Forwarded /
+        # X-Forwarded-* headers; leave off when directly exposed.
+        trust_proxy_headers=os.getenv("BEHIND_PROXY") == "true",
         cors=bool(os.getenv("CORS_ORIGINS")),
         cors_params={
             "allow_origins": os.getenv("CORS_ORIGINS", "").split(","),