Express and Fastify

Before you start

A firewall integration enforces the signed policy bundle of your site in front of your origin: block, redirect, challenge and token-gated routes. It fetches the bundle from GET /v1/policies/<site key>, verifies its signature offline and decides every request the same way in every language. It does not replace verifying tokens in your own code. A request that reaches your origin another way (a direct IP, another hostname, a path the integration was not installed on) is never evaluated, so let only the integration reach the origin. See firewall policies.

The secret key (rgsk_...) is needed only for requireToken rules. Without it such a rule applies its onError setting.

Install and mount

Package @revokegpt/firewall-node.

• Express refuses to pass any request unless app.set('case sensitive routing', true) was called. Mount it first: anything before it (a router, express.static, a body parser) can answer a request the firewall never sees. Mounting it before express.json() is correct and required.
• Fastify: await app.register(revokeGPTFastify({ siteKey })) from @revokegpt/firewall-node/fastify, on the root instance before the routes. It refuses to register if the instance was built with caseSensitive: false.
• Plain node:http: const fw = revokeGPTNodeHttp({ siteKey }), then if (await fw(req, res)) app(req, res); a false means the firewall already answered.
• Behind a reverse proxy, make the proxy forward the original Host header: the firewall ignores X-Forwarded-Host on purpose.

server.ts

import { revokeGPTExpress } from '@revokegpt/firewall-node/express';
import express from 'express';

const app = express();
app.set('case sensitive routing', true); // required: rules match paths case-sensitively
app.use(
  revokeGPTExpress({
    siteKey: process.env.RG_SITE_KEY ?? '',
    secretKey: process.env.RG_SECRET_KEY,
  }),
); // FIRST
app.get('/', (_req, res) => res.send('ok'));
app.listen(8080);

Not published yet

This integration package is built and tested in the repository but not published to its registry yet. Install it from a checkout until the first release.

Keep routing case-sensitive

Firewall rules match paths case-sensitively, so /ADMIN is not /admin. If your origin routes case-insensitively (IIS, a case-folding proxy or framework), /ADMIN can reach the /admin handler while a rule on /admin never sees it. Make the origin case-sensitive, or write a rule for each spelling it serves.