You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Merge branch 'main' of github.com:AikidoSec/node-RASP into hansott-patch-1
* 'main' of github.com:AikidoSec/node-RASP: (34 commits)
When Zen starts
Add note about loading env variables in ESM mode
Add separate heartbeat e2e test
Fix e2e test
Add e2e test
Fix missing outbound hostname
Add extra comment to make intent clear
Reduce diff
Format code after merge
Update package.json
Update .github/workflows/lint-code.yml
Update .prettierignore
Remove prettier config in adonis sample app
Fix duplicate prettier install & format
Add end2end tests for blocking outbound connections
Fix test
Fix tests
Align message with expected test message
Simplify InspectionResult and move domains to normal config
Update ipAddress type for attack wave
...
[](https://github.com/AikidoSec/firewall-node/actions/workflows/end-to-end-tests.yml)
[](https://github.com/AikidoSec/firewall-node/actions/workflows/end-to-end-tests.yml)
11
11
12
12
Zen, your in-app firewall for peace of mind– at runtime.
13
13
@@ -19,100 +19,100 @@ It protects your Node.js apps by scanning user input and where that data eventua
19
19
20
20
Zen will autonomously protect your Node.js applications against:
* ✅ [`@koa/router`](https://www.npmjs.com/package/@koa/router) 14.x, 13.x, 12.x, 11.x and 10.x
104
+
- ✅ [`@koa/router`](https://www.npmjs.com/package/@koa/router) 14.x, 13.x, 12.x, 11.x and 10.x
105
105
106
106
### AI SDKs
107
107
108
108
Zen instruments the following AI SDKs to track which models are used and how many tokens are consumed, allowing you to monitor your AI usage and costs:
_Note: Prompt injection attacks are currently not covered by Zen._
118
118
@@ -154,18 +154,18 @@ If an attack on your application is detected, we report immediately allowing you
154
154
155
155
You can easily select which IP addresses and/or bots to block from curated lists inside our Dashboard.
156
156
157
-
158
157
You will need an Aikido account and a token to report events to Aikido. If you don't have an account, you can [sign up for free](https://app.aikido.dev/login). (No credit card required)
159
158
160
159
Here's how:
161
-
*[Log in to your Aikido account](https://app.aikido.dev/login).
162
-
* Go to [Zen](https://app.aikido.dev/runtime/services).
163
-
* Go to apps.
164
-
* Click on **Add app**.
165
-
* Choose a name for your app.
166
-
* Click **Generate token**.
167
-
* Copy the token.
168
-
* Set the token as an environment variable, `AIKIDO_TOKEN`, using [dotenv](https://github.com/motdotla/dotenv) or another method of your choosing.
160
+
161
+
-[Log in to your Aikido account](https://app.aikido.dev/login).
162
+
- Go to [Zen](https://app.aikido.dev/runtime/services).
163
+
- Go to apps.
164
+
- Click on **Add app**.
165
+
- Choose a name for your app.
166
+
- Click **Generate token**.
167
+
- Copy the token.
168
+
- Set the token as an environment variable, `AIKIDO_TOKEN`, using [dotenv](https://github.com/motdotla/dotenv) or another method of your choosing.
169
169
170
170
## Running in production (blocking) mode
171
171
@@ -185,7 +185,7 @@ This program is offered under a commercial and under the AGPL license.
185
185
You can be released from the requirements of the AGPL license by purchasing
186
186
a commercial license. Buying such a license is mandatory as soon as you
187
187
develop commercial activities involving the Zen software without
188
-
disclosing the source code of your own applications.
188
+
disclosing the source code of your own applications.
189
189
190
190
For more information, please contact Aikido Security at this
191
191
address: [email protected] or create an account at https://app.aikido.dev.
> Please also check the documentation on how to integrate Zen with your used web framework.
20
20
21
+
## Loading environment variables
22
+
23
+
When using `--require`/`-r` to preload the Zen firewall, the instrumentation hook runs before your application code. This means environment variables loaded by packages like `dotenv` will not be available when Zen starts.
24
+
25
+
To ensure `AIKIDO_TOKEN` and other environment variables are available during instrumentation, use Node.js's native `--env-file` flag:
> The `--env-file` flag cannot be used in `NODE_OPTIONS`.
33
+
21
34
## Known issues
22
35
23
36
- Zen can not protect ESM sub-dependencies of an ESM package. For example if an ESM package `foo` imports a sub-dependency `bar` that is also an ESM package, Zen will not be able to protect the code in `bar`. This is because the V8 engine does not allow Node.js to observe the evaluation of inner ESM packages (yet). Open issue: [Adding an evaluation hook for v8::Module](https://issues.chromium.org/u/1/issues/384413088). See a full example below.
Copy file name to clipboardExpand all lines: docs/fastify.md
+10-6Lines changed: 10 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -80,12 +80,16 @@ async function authenticate(request, reply) {
80
80
});
81
81
}
82
82
83
-
fastify.get('/dashboard', {
84
-
preHandler: [authenticate, Zen.fastifyHook],
85
-
// ^ Add the Zen hook after your authentication logic
86
-
}, async (request, reply) => {
87
-
return { message:"Welcome to your dashboard!" };
88
-
});
83
+
fastify.get(
84
+
"/dashboard",
85
+
{
86
+
preHandler: [authenticate, Zen.fastifyHook],
87
+
// ^ Add the Zen hook after your authentication logic
88
+
},
89
+
async (request, reply) => {
90
+
return { message:"Welcome to your dashboard!" };
91
+
}
92
+
);
89
93
```
90
94
91
95
This approach allows user blocking and rate limiting to work properly when authentication runs in the `preHandler` stage where the request body is parsed.
0 commit comments