arcjet js

Arcjet JS SDKs. Bot detection, rate limiting, email validation, attack protection, data redaction for Node.js, Next.js, Deno, Bun, Remix, SvelteKit, NestJS.

arcjet
385
11
TypeScript
Arcjet Logo

Arcjet - JS SDK

npm badge

Arcjet helps developers protect their apps in just a few lines of
code. Bot detection. Rate limiting. Email validation. Attack protection. Data
redaction. A developer-first approach to security.

This is the monorepo containing various Arcjet open source packages
for JS.

Features

Arcjet security features for protecting JS apps:

  • 🤖 Bot protection - manage traffic by automated
    clients and bots.
  • 🛑 Rate limiting - limit the number of requests a
    client can make.
  • 🛡️ Shield WAF - protect your application against common
    attacks.
  • 📧 Email validation - prevent users from
    signing up with fake email addresses.
  • 📝 Signup form protection - combines rate
    limiting, bot protection, and email validation to protect your signup forms.
  • 🕵️‍♂️ Sensitive information detection - block
    personally identifiable information (PII).
  • 🚅 Nosecone - set security headers such as
    Content-Security-Policy (CSP).

Quick start

Get help

Join our Discord server or reach out for support.

Example apps

Blueprints

Usage

Read the docs at docs.arcjet.com.

Next.js bot detection

This example will enable Arcjet bot protection
across your entire Next.js application. Next.js middleware runs before every
request, allowing Arcjet to protect your entire application before your code
runs.

It will return a 403 Forbidden response for all requests from bots not in the
allow list.

// middleware.ts
import arcjet, { ArcjetRuleResult, detectBot } from "@arcjet/next";
import { NextRequest, NextResponse } from "next/server";

export const config = {
  // matcher tells Next.js which routes to run the middleware on.
  // This runs the middleware on all routes except for static assets.
  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
};
const aj = arcjet({
  key: process.env.ARCJET_KEY!, // Get your site key from https://app.arcjet.com
  rules: [
    detectBot({
      mode: "LIVE", // will block requests. Use "DRY_RUN" to log only
      // Block all bots except the following
      allow: [
        "CATEGORY:SEARCH_ENGINE", // Google, Bing, etc
        // Uncomment to allow these other common bot categories
        // See the full list at https://arcjet.com/bot-list
        //"CATEGORY:MONITOR", // Uptime monitoring services
        //"CATEGORY:PREVIEW", // Link previews e.g. Slack, Discord
      ],
    }),
  ],
});

function isSpoofed(result: ArcjetRuleResult) {
  return (
    // You probably don't want DRY_RUN rules resulting in a denial
    // since they are generally used for evaluation purposes but you
    // could log here.
    result.state !== "DRY_RUN" &&
    result.reason.isBot() &&
    result.reason.isSpoofed()
  );
}

export default async function middleware(request: NextRequest) {
  const decision = await aj.protect(request);

  // Bots not in the allow list will be blocked
  if (decision.isDenied()) {
    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
  }

  // Arcjet Pro plan verifies the authenticity of common bots using IP data.
  // Verification isn't always possible, so we recommend checking the results
  // separately.
  // https://docs.arcjet.com/bot-protection/reference#bot-verification
  if (decision.results.some(isSpoofed)) {
    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
  }

  return NextResponse.next();
}

Node.js bot protection example

This simple Node.js server is protected with Arcjet bot
protection. It will return a 403 Forbidden
response for all requests from bots not in the allow list.

// server.ts
import arcjet, { detectBot } from "@arcjet/node";
import http from "node:http";

const aj = arcjet({
  key: process.env.ARCJET_KEY!, // Get your site key from https://app.arcjet.com
  rules: [
    detectBot({
      mode: "LIVE", // will block requests. Use "DRY_RUN" to log only
      // configured with a list of bots to allow from
      // https://arcjet.com/bot-list
      // Block all bots except the following
      allow: [
        "CATEGORY:SEARCH_ENGINE", // Google, Bing, etc
        // Uncomment to allow these other common bot categories
        // See the full list at https://arcjet.com/bot-list
        //"CATEGORY:MONITOR", // Uptime monitoring services
        //"CATEGORY:PREVIEW", // Link previews e.g. Slack, Discord
      ],
    }),
  ],
});

const server = http.createServer(async function (
  req: http.IncomingMessage,
  res: http.ServerResponse,
) {
  const decision = await aj.protect(req);
  console.log("Arcjet decision", decision);

  if (decision.isDenied()) {
    res.writeHead(403, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ error: "Forbidden" }));
  } else {
    res.writeHead(200, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ message: "Hello world" }));
  }
});

server.listen(8000);

Packages

We provide the source code for various packages in this repository, so you can
find a specific one through the categories and descriptions below.

SDKs

Analysis

Nosecone

See the docs for details.

Utilities

Internal development

Support

This repository follows the Arcjet Support Policy.

Security

This repository follows the Arcjet Security Policy.

License

Licensed under the Apache License, Version 2.0.