Arcjet helps developers protect their apps in just a few lines of
code. Implement rate limiting, bot protection, email verification, and defense
against common attacks.
This is the Arcjet TypeScript and JavaScript SDK core.
Generally, you'll want to use the Arcjet SDK for your specific framework, such
as @arcjet/next for Next.js. However, this package
can be used to interact with Arcjet if your framework does not have an
integration.
Installation
npm install -S arcjet
Rate limit + bot detection example
The example below applies a token bucket rate limit rule to a route where we
identify the user based on their ID e.g. if they are logged in. The bucket is
configured with a maximum capacity of 10 tokens and refills by 5 tokens every 10
seconds. Each request consumes 5 tokens.
Bot detection is also enabled to block requests from known bots.
import http from"http";
import arcjet, { createRemoteClient, tokenBucket, detectBot } from"arcjet";
import { baseUrl } from"@arcjet/env";
import { createConnectTransport } from"@connectrpc/connect-node";
const aj = arcjet({
// Get your site key from https://app.arcjet.com// and set it as an environment variable rather than hard coding.// See: https://www.npmjs.com/package/dotenvkey: process.env.ARCJET_KEY,
characteristics: ["userId"], // track requests by a custom user IDrules: [
// Create a token bucket rate limit. Other algorithms are supported.tokenBucket({
mode: "LIVE", // will block requests. Use "DRY_RUN" to log onlyrefillRate: 5, // refill 5 tokens per intervalinterval: 10, // refill every 10 secondscapacity: 10, // bucket maximum capacity of 10 tokens
}),
detectBot({
mode: "LIVE", // will block requests. Use "DRY_RUN" to log only// configured with a list of bots to allow from// https://arcjet.com/bot-listallow: [], // "allow none" will block all detected bots
}),
],
client: createRemoteClient({
transport: createConnectTransport({
baseUrl: baseUrl(process.env),
httpVersion: "2",
}),
}),
});
const server = http.createServer(asyncfunction (
req: http.IncomingMessage,
res: http.ServerResponse,
) {
// Any sort of additional context that might want to be included for the// execution of `protect()`. This is mostly only useful for writing adapters.const ctx = {};
// Construct an object with Arcjet request detailsconst path = newURL(req.url || "", `http://${req.headers.host}`);
const details = {
ip: req.socket.remoteAddress,
method: req.method,
host: req.headers.host,
path: path.pathname,
};
const decision = await aj.protect(ctx, details, { requested: 5 }); // Deduct 5 tokens from the bucketconsole.log(decision);
if (decision.isDenied()) {
res.writeHead(403, { "Content-Type": "application/json" });
res.end(JSON.stringify({ error: "Forbidden" }));
} else {
res.writeHead(200, { "Content-Type": "application/json" });
res.end(JSON.stringify({ data: "Hello World!" }));
}
});
server.listen(8000);
We found that arcjet demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.It has 2 open source maintainers collaborating on the project.
Package last updated on 23 Oct 2024
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
The Socket Research Team uncovered a malicious Python package typosquatting the popular 'fabric' SSH library, silently exfiltrating AWS credentials from unsuspecting developers.
An advanced npm supply chain attack is leveraging Ethereum smart contracts for decentralized, persistent malware control, evading traditional defenses.
By Kush Pandya, Philipp Burckhardt, Kirill Boychenko, Orlando Barrera - Oct 31, 2024