Documentation
¶
Overview ¶
Package shield provides AI-powered request protection middleware for Nimbus.
Shield detects and blocks malicious requests including prompt injection, SQL injection, XSS, path traversal, command injection, and bot abuse. It works without requiring an external AI API by using pattern-based detection with scoring, but can optionally leverage the AI SDK for advanced content analysis.
Usage:
app.Router.Use(shield.Guard()) // defaults
app.Router.Use(shield.Guard(shield.Config{Level: "strict"}))
app.Router.Post("/api/chat", shield.AIContentGuard(), handler) // AI-specific
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AIContentGuard ¶
func AIContentGuard(cfgs ...Config) router.Middleware
AIContentGuard is a specialized middleware for AI/LLM endpoints that performs deep prompt injection analysis on request bodies containing "prompt", "message", "content", "input", or "query" fields.
func Guard ¶
func Guard(cfgs ...Config) router.Middleware
Guard returns the Shield middleware that inspects every request for threats.
Types ¶
type BlockEvent ¶
type BlockEvent struct {
Timestamp time.Time `json:"timestamp"`
IP string `json:"ip"`
Method string `json:"method"`
Path string `json:"path"`
Threat string `json:"threat"`
Category string `json:"category"`
Score int `json:"score"`
Details string `json:"details"`
Blocked bool `json:"blocked"`
MatchedRaw string `json:"matched_raw,omitempty"`
UserAgent string `json:"user_agent,omitempty"`
}
BlockEvent records details of a blocked or flagged request.
type Config ¶
type Config struct {
// Level: "permissive", "balanced" (default), "strict"
Level string
// Enabled modules (all true by default).
SQLInjection bool
XSS bool
PathTraversal bool
CommandInjection bool
PromptInjection bool
BotDetection bool
PayloadSize bool
RateBurst bool
HeaderAnomalies bool
// MaxBodySize is the maximum allowed body size in bytes (default 10MB).
MaxBodySize int64
// RateBurstLimit is max requests per second from a single IP (default 100).
RateBurstLimit int
// RateBurstWindow is the rate burst measurement window.
RateBurstWindow time.Duration
// BlockAction: "reject" (403, default), "challenge", "log"
BlockAction string
// CustomRules are additional pattern rules to check.
CustomRules []Rule
// OnBlock is called when a request is blocked.
OnBlock func(event BlockEvent)
// OnWarn is called when a request scores above warning threshold.
OnWarn func(event BlockEvent)
// AllowedIPs that bypass all checks.
AllowedIPs []string
// TrustedProxies for X-Forwarded-For parsing.
TrustedProxies []string
// ScoreThreshold overrides the default blocking threshold (0-100).
// Default is based on level: permissive=70, balanced=50, strict=30.
ScoreThreshold int
}
Config configures the Shield middleware.
Source Files