Arcjet limitations

No security product is perfect and Arcjet is no exception. Here are some things to be aware of when building your application with Arcjet.

Your application receives traffic

Network-based security products block traffic before it hits your application. This works well for high-volume network attacks, so leave those to the DDoS protection built into your hosting platform.

Arcjet is designed to integrate into your application and understand more about the request context. This lets Arcjet apply the right rules, and lets you customize the response based on the signals that Arcjet provides. You can also show useful error messages rather than returning generic status codes.

For example, it is difficult for network based security products to distinguish between a free user making excessive API calls and your largest paying customer performing important queries. Likewise, you may want to manually review users signing up from behind a proxy who have disposable email addresses, but allow those with business emails to sign up instantly.

We believe application context is critical, and that is what Arcjet is designed for. It also means that your application receives more traffic than if the network had blocked it.

Shield analysis does not use the request body

Arcjet Shield analysis is based on the request headers and query parameters. To minimize false positives and achieve low-latency responses, Shield analysis happens in the background on the Arcjet platform after a request has been reported to our API. For privacy we do not send the request body to our API, so it cannot be used for analysis.

Local request body analysis is on the Arcjet roadmap for Shield.

Discussion