API security middleware for Node.js apps.
iri-shield monitors API traffic, detects suspicious behaviour, tracks client identity drift, redacts sensitive response data, stores events, and provides a dashboard for research evaluation.
Package
iri-shield
Author
ansari-in
Dashboard
admin/admin
Storage
sqlite
Monitoring
Captures IP, URL, method, user-agent, cookies, sessions, client id, device id, status and latency.
Detection
Flags SQL injection, XSS, path traversal, sensitive endpoint probes, rate abuse and identity changes.
Research Data
Use client_requests.json and replay scripts to generate normal and fake attacker traffic for evaluation.
Private Admin APIs
Stats and metrics are not public. First login, then use the Bearer token.
curl -X POST http://[REDACTED]/login \
-H "content-type: application/json" \
-d "{\"username\":\"admin\",\"password\":\"admin\"}"
curl http://[REDACTED]/api/stats \
-H "authorization: Bearer YOUR_TOKEN"
Useful URLs
Dashboard: /iri-shield
Live docs/site: https://[REDACTED]/
Package docs: GitHub README
NPM package: npmjs.com/package/iri-shield
API Routes
| Method | URL | Purpose | Access |
|---|---|---|---|
GET | /api/public | Public monitored endpoint | public |
GET | /api/products | Public sample endpoint | public |
GET | /api/users/1 | Public endpoint with PII redaction example | public |
GET | /api/search?q=%27%20or%201%3D1 | Threat detection test | test threat |
POST | /login | Returns admin JWT for private APIs | public |
GET | /api/private | Requires x-api-key: iri-example-key | authenticated |
GET | /api/jwt-profile | Requires Bearer token | authenticated |
GET | /api/stats | Private stats API, requires Bearer token | authenticated |
GET | /metrics | Private metrics API, requires Bearer token | authenticated |
POST | /research/replay | Private dataset replay, requires Bearer token | authenticated |
GET | /iri-shield | Private dashboard, admin/admin | authenticated |