Skip to main content

Security and network configuration

These sections limit callers on supported public proxy handlers. They control browser origins and payload sizes on the LLM proxy paths supported at this time.

They also identify traffic that occurs more than one time and has bot indicators. These controls do not replace a network boundary around the listener or its management endpoints.

IP allowlist​

ip_allowlist:
  cidrs:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.1.0/24
    - 203.0.113.42/32
  trusted_proxy_cidrs:
    - 10.10.0.0/16
FieldTypeNotes
cidrsstring[]This field contains the permitted IPv4 or IPv6 CIDR ranges.
trusted_proxy_cidrsstring[]These IPv4 or IPv6 CIDRs can append X-Forwarded-For.

The gateway ignores forwarding headers from an untrusted direct peer. For a trusted peer, it reads X-Forwarded-For from right to left.

It stops at the first address that is not in trusted_proxy_cidrs.

ip_allowlist runs on public proxy handlers that use the shared request checks. Health, configuration, and administrative endpoints do not use this allowlist.

If you must limit these endpoints, protect the complete listener with deployment network controls.

CORS​

cors:
  enabled: true
  allow_origins:
    - https://app.example.com
    - https://staging.example.com
  allow_methods:
    - GET
    - POST
    - OPTIONS
  allow_headers:
    - Content-Type
    - Authorization
    - X-Custom-Header
  expose_headers:
    - X-Request-Id
    - X-RateLimit-Remaining
  allow_credentials: true
  max_age_seconds: 3600
FieldTypeNotes
enabledbooleanThis field turns CORS headers on or off.
allow_originsstring[]This field contains the permitted origins.
allow_methodsstring[]This field contains the permitted HTTP methods.
allow_headersstring[]This field contains the permitted request headers.
expose_headersstring[]This field contains response headers that browser JavaScript can read.
allow_credentialsbooleanThis field lets requests have credentials.
max_age_secondsintegerThis field sets the preflight cache time.

When allow_credentials: true, do not use * in allow_origins.

Size limits​

size_limits:
  max_body_bytes: 1048576
  max_header_bytes: 8192
  max_url_bytes: 4096
  max_response_bytes: 10485760
FieldTypeNotes
max_body_bytesintegerThis is the maximum raw request body size.
max_header_bytesintegerThis is the maximum header block size.
max_url_bytesintegerThis is the maximum request URL length.
max_response_bytesintegerThis is the maximum size of the upstream response body.

At this time, request body, header, and URL limits apply only to Chat Completions. A limit failure returns HTTP 413.

The response limit applies to buffered Chat Completions and Responses requests. An oversized buffered response returns HTTP 502 with response_size_exceeded.

An oversized stream gets a terminal SSE error before the gateway stops the stream. These fields do not limit other request types across the gateway.

See rate limit configuration for the complete runtime boundary.

Bot detector​

bot-detector makes request fingerprints from selected headers. It compares requests with matching data in a moving time window.

The policy returns warn or block when the traffic has automation indicators.

pack:
  name: config-security-network-example-8
  version: 1.0.0
  enabled: true
policies:
  chain:
    - bot-detector
policy:
  bot-detector:
    fingerprint_fields:
      - user-agent
      - x-forwarded-for
      - authorization
    profile_window_seconds: 60
    similarity_threshold: 0.9
    max_requests_per_window: 25
    action: block
FieldTypeNotes
fingerprint_fieldsstring[]The policy uses these headers to make the request fingerprint.
profile_window_secondsintegerThis is the moving window for comparison and counting.
similarity_thresholdnumberThis value sets the necessary similarity for requests from one bot-like source.
max_requests_per_windowintegerThis is the maximum permitted count of requests with matching data in one window.
actionstringwarn or block.

Complete security example​

pack:
  name: secured-gateway
  version: 1.0.0
  enabled: true
providers:
  targets:
    - id: openai-prod
      provider: openai
      model: your-openai-model
      secret_key_ref:
        env: VERDICTAN_OPENAI_API_KEY
ip_allowlist:
  cidrs:
    - 10.0.0.0/8
    - 172.16.0.0/12
  trusted_proxy_cidrs:
    - 10.10.0.0/16
cors:
  enabled: true
  allow_origins:
    - https://app.example.com
  allow_methods:
    - POST
    - OPTIONS
  allow_headers:
    - Content-Type
    - Authorization
  allow_credentials: true
  max_age_seconds: 7200
size_limits:
  max_body_bytes: 2097152
  max_header_bytes: 16384
  max_url_bytes: 8192
  max_response_bytes: 20971520
policies:
  chain:
    - bot-detector
    - prompt-injection
    - pii-detector
policy:
  bot-detector:
    fingerprint_fields:
      - user-agent
      - x-forwarded-for
      - authorization
    profile_window_seconds: 60
    similarity_threshold: 0.9
    max_requests_per_window: 25
    action: warn
  prompt-injection:
    response:
      action: block
  pii-detector:
    action: redact

Next steps​