@arcjet/deno

@arcjet/deno

Arcjet helps developers protect their apps in just a few lines of code. Implement rate limiting, bot protection, email verification & defense against common attacks.

This is the Arcjet SDK for Deno.

Rate limit + bot detection example

The Arcjet rate limit example below applies a token bucket rate limit rule to a route where we identify the user based on their ID e.g. if they are logged in. The bucket is configured with a maximum capacity of 10 tokens and refills by 5 tokens every 10 seconds. Each request consumes 5 tokens.

import "jsr:@std/dotenv/load";

import arcjet, { tokenBucket, detectBot } from "npm:@arcjet/deno";

const aj = arcjet({
  key: Deno.env.get("ARCJET_KEY")!, // Get your site key from https://app.arcjet.com
  characteristics: ["userId"], // track requests by a custom user ID
  rules: [
    // Create a token bucket rate limit. Other algorithms are supported.
    tokenBucket({
      mode: "LIVE", // will block requests. Use "DRY_RUN" to log only
      refillRate: 5, // refill 5 tokens per interval
      interval: 10, // refill every 10 seconds
      capacity: 10, // bucket maximum capacity of 10 tokens
    }),
    detectBot({
      mode: "LIVE", // will block requests. Use "DRY_RUN" to log only
      // configured with a list of bots to allow from
      // https://arcjet.com/bot-list
      allow: [], // "allow none" will block all detected bots
    }),
  ],
});

Deno.serve(
  aj.handler(async function (req: Request) {
    const userId = "user123"; // Replace with your authenticated user ID
    const decision = await aj.protect(req, { userId, requested: 5 }); // Deduct 5 tokens from the bucket
    console.log("Arcjet decision", decision);

    if (decision.isDenied()) {
      return Response.json({ error: "Forbidden" }, { status: 403 });
    } else {
      return Response.json({ message: "Hello world" });
    }
  }),
);

Shield example

Arcjet Shield protects your application against common attacks, including the OWASP Top 10. You can run Shield on every request with negligible performance impact.

import "jsr:@std/dotenv/load";

import arcjet, { shield } from "npm:@arcjet/deno";

const aj = arcjet({
  key: Deno.env.get("ARCJET_KEY")!, // Get your site key from https://app.arcjet.com
  rules: [
    shield({
      mode: "LIVE", // will block requests. Use "DRY_RUN" to log only
    }),
  ],
});

Deno.serve(
  aj.handler(async function (req: Request) {
    const decision = await aj.protect(req);

    if (decision.isDenied()) {
      return Response.json({ error: "Forbidden" }, { status: 403 });
    } else {
      return Response.json({ message: "Hello world" });
    }
  }),
);

License

Licensed under the Apache License, Version 2.0.

Changelog

1.0.0-alpha.28 (2024-10-23)

⚠ BREAKING CHANGES

• ip: Accept Request or IncomingMessage directly (#2018)
• ip: Exit early if platform-specific headers are missing IP (#2021)
• Ensure performance metrics are scoped to same call (#2019)
• Return ERROR decision when fingerprint cannot be generated (#1990)
• protocol: Remove received_at and decision fields from Report (#1988)
• analyze: improve sensitive info string token accuracy (#1962)
• Update Wasm with phone-number fix and tokenizer update (#1854)
• Remove match option from rate limit rules (#1815)

🚀 New Features

• Add Remix adapter (#1866) (32d6d41), closes #1313
• analyze: improve sensitive info string token accuracy (#1962) (abad1bd)
• ip: Accept Request or IncomingMessage directly (#2018) (1704da8), closes #1904
• ip: Add Vercel platform-specific IP header detection (#2022) (d886c76)
• nextjs: Support Next.js Server Actions (#1991) (07e68dc), closes #1200
• Use waitUntil for Report call if available (#1838) (2851021), closes #884

🪲 Bug Fixes

• arcjet: Ensure performance measurements are 1-to-1 and always captured (#1858) (4d29f9a)
• Ensure performance metrics are scoped to same call (#2019) (e9f869c), closes #1865
• ip: Exit early if platform-specific headers are missing IP (#2021) (1a13d9c)
• nestjs: Lookup request from GraphQL context in ArcjetGuard (#1857) (c0b2903), closes #1856
• Return ERROR decision when fingerprint cannot be generated (#1990) (618a1ee), closes #1801
• Update Wasm with phone-number fix and tokenizer update (#1854) (f94f078)

🧹 Miscellaneous Chores

• Add README links for new adapters (#1831) (81885d9), closes #1813
• analyze: Regenerate Wasm with updated dependencies (#2067) (f96994c)
• examples: Reorganize examples for clarity and decoupling from Next.js version (#2017) (8568bf2)
• examples: Various cleanup (#2066) (c626228)
• protocol: Remove received_at and decision fields from Report (#1988) (3da543e)
• Remove match option from rate limit rules (#1815) (853119d), closes #1810