Tutorial

Protect an existing origin

  1. Leave your app on its current port (example 3000). Do not publish that port.
  2. Start xorappsec in detect-learn (default policy mode if you change it, or start prevent-learn only on a playground): 
    xorappsec all --upstream http://127.0.0.1:3000 --listen 0.0.0.0:8080
  3. Point clients, load tests, and your browser at :8080, not :3000.
  4. Watch /api/v1/events and the Learn tab for a day of real traffic.
  5. Add trusted sources (editors, CI egress) — they are not an allow-list.
  6. When the level is Graduate / Master, switch the asset to prevent-learn. See graduate to prevent.

If xorappsec sits behind another proxy, list that hop in trusted-proxies or reputation and rate limits key on the load balancer.