Skip to main content

​
Overview

Null Pass uses Arcjet for comprehensive request protection including rate limiting, bot detection, and shield protection.

​
Protection Features

Token bucket algorithm prevents abuse by limiting requests per time window.Default Configuration:
  • Most endpoints: Standard rate limit
  • Registration/Login: 2 requests per bucket
  • Password change: 2 requests per bucket
Arcjet analyzes request patterns to detect and block automated bots and scrapers.
Additional layer of protection against malicious requests and attacks.
Email validation for registration endpoint to prevent invalid or disposable emails.
Detects and blocks requests containing sensitive information like API keys or passwords.

​
Implementation

​
Code Reference

// lib/arcjet.ts
import { protectRoute } from '@/lib/arcjet'

// Usage in routes
const blocked = await protectRoute(request, { requested: 2 })
if (blocked) return blocked

​
Protection Levels

Different endpoints use different protection levels:
  • Standard: Default Arcjet protection
  • High: Registration, login, password change (2 requests per bucket)

​
Error Responses

When blocked by Arcjet, endpoints return: 
{
  "error": "Rate limit exceeded"
}
Status Code: 403 Forbidden

​
Configuration

Arcjet is configured via environment variables:
​
ARCJET_KEY
string
required
Arcjet API key for authentication

​
Best Practices

For Internal Use:
  • Monitor rate limit errors in logs
  • Implement exponential backoff for retries
  • Cache responses where appropriate
  • Use appropriate request patterns to avoid triggering limits
Rate limits are per IP address and endpoint. Different endpoints have different limits.

​
Monitoring

Rate limit violations are logged:
  • Check application logs for Arcjet blocking events
  • Monitor 403 responses for rate limit patterns
  • Adjust protection levels if needed for legitimate use cases

​
Bypassing (Internal Only)

For internal testing or admin operations:
  • Use admin endpoints if available
  • Contact system administrator for rate limit adjustments
  • Use different IP addresses for testing (not recommended for production)