Middleware
Apply the generated security boundary before application routes:
app.use(auth.helmet);
app.use(auth.rateLimit);
app.get('/protected', auth.requireAuth, protectedHandler);
app.get('/admin', auth.requireAdmin, adminHandler);
app.use('/internal', auth.ipWhitelist);
| Middleware | Purpose |
|---|---|
auth.helmet | Applies secure HTTP response headers |
auth.rateLimit | Enforces a Redis-backed limit per client IP |
auth.requireAuth | Verifies a human access token and rejects revoked sessions |
auth.requireAdmin | Requires an active human session with the administrator role |
auth.ipWhitelist | Restricts a route to active IP or CIDR entries |
auth.incognito | Issues and verifies a purpose-bound guest token for the request |
The default rate limiter allows 100 requests per 60 seconds and applies a 300-second block. If Redis is unavailable, the security boundary does not silently behave as an in-memory distributed limiter.
Proxy forwarding headers are ignored unless the application explicitly enables trusted proxy handling. Only enable it behind a proxy that overwrites untrusted forwarding headers.
Human middleware rejects agent token classes. Use the separate agent identity middleware for machine routes.