Repository navigation
feat: clearance enforcement on Vercel for any framework (0.20.0) - #65
Merged
Merged
Conversation
WebDecoy's clearance validator, the decision its Cloudflare, AWS and Netlify validators make, now runs as Vercel middleware with no proxy in front: - @webdecoy/node/vercel: Routing Middleware for Astro, SvelteKit, Nuxt, Remix or static sites. - withClearance() in @webdecoy/nextjs for Next.js middleware. - createClearanceGate() in @webdecoy/node for other edge adapters. The gate is generated from WebDecoy's validator source (src/clearance/gate.generated.js) and never edited here; a test fails on a hand edit. Configured by WEBDECOY_SITE_KEY, WEBDECOY_SCANNER_ID and WEBDECOY_SENSOR_KEY, follows the site's WebDecoy mode, fails open.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds WebDecoy clearance enforcement as Vercel middleware, for any framework:
@webdecoy/node/vercel: Routing Middleware (export { default } from '@webdecoy/node/vercel') for Astro, SvelteKit, Nuxt, Remix or static sites.withClearance()in@webdecoy/nextjs.createClearanceGate()in@webdecoy/nodefor other edge adapters.On the paths a site protects in WebDecoy, a visitor needs a clearance token. A real browser earns one on a short check page; a client that runs no JavaScript never gets the page. It follows the site's WebDecoy mode (monitor until enforce) and fails open.
src/clearance/gate.generated.jsis generated from WebDecoy's validator source (the same decision as the Cloudflare, AWS and Netlify validators), minified and comment-free.vercel.test.tsfails if it is edited by hand.Tests: Vercel continue-with-headers protocol, a real Ed25519 token accepted, a token for another tenant rejected, monitor mode, forged verdict stripped, missing config is a pass-through, env configuration, fail-open, and the whole middleware run inside the Edge Runtime VM. Bumps all packages to 0.20.0.