rshield

An Actix-web middleware for checking IP addresses to identify unglobal, malicious, and TOR connections. It provides the browser with a zero-click Proof of Work (PoW) task, or, if JavaScript is disabled, a one-click CAPTCHA image challenge.

Install

cargo add rshield

Or from git:

[dependencies]
rshield = { git = "https://github.com/tn3w/rshield" }

Rust 1.88 or newer. A Redis server on 127.0.0.1:6379 is used for caching.

How it works

1. Each request's peer IP is checked: unglobal ranges, known malicious addresses (ipapi), TOR exit nodes.
2. Results are cached in Redis.
3. Flagged clients get a challenge page in their Accept-Language (107 languages).
4. Browsers with JavaScript solve a zero-click proof-of-work task; without JavaScript, a one-click image CAPTCHA is shown.

Quick start

use actix_web::{web, App, HttpResponse, HttpServer};
use rshield::{CookieMiddleware, RequestValidationMiddleware};

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    HttpServer::new(|| {
        App::new()
            .wrap(RequestValidationMiddleware)
            .service(web::scope("").route(
                "/",
                web::get().to(|| async { HttpResponse::Ok().body("Hello World!") }),
            ))
            .wrap(CookieMiddleware)
    })
    .bind("127.0.0.1:8080")?
    .run()
    .await
}

CookieMiddleware must be registered after all services, RequestValidationMiddleware depends on it.

Development

git clone https://github.com/tn3w/rshield.git
cd rshield
cargo fmt
cargo clippy --all-targets -- -D warnings
cargo test                  # unit tests
cargo test -- --ignored --skip benchmark   # network + Redis tests

Redis and OpenSSL headers are needed locally:

sudo apt-get install redis libssl-dev -y
redis-server --daemonize yes

See CONTRIBUTING.md and SECURITY.md.

Attribution

• Logo icon: Rust icons created by Freepik - Flaticon

License

Apache-2.0