Security

Configurations in Security.

Configurations

• Basic Auth — Authenticate requests using HTTP Basic Authentication (RFC 7617)
• Cors — Spec-compliant CORS filter with preflight handling, origin validation, and credential support
• Credential Injection Env Vars — Injects per-service API credentials read from environment variables, so no secret is written into the config
• Credential Injection — Injects per-cluster API credentials into upstream requests
• Csrf — Cross-site request forgery protection via origin validation
• Downstream Read Timeout — Protects against slow client attacks by limiting how long the proxy waits for data from downstream clients
• Forwarded Headers — Injects X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Host into upstream requests
• Guardrails Per Model — Runs body-inspecting guardrails only for a model selected from the request body
• Guardrails — Reject requests that match header or body inspection rules
• Ip Acl — Allow or deny requests by source IP/CIDR
• Peer Identity Trust — Validates downstream mTLS peer identity against a set of trusted peers
• Policy Api Key — Authenticates generic HTTP traffic with API keys using the Praxis Policy Engine
• Policy Assertions — Projects policy-derived identity into request headers and removes credentials that should not reach the upstream
• Policy Context — Demonstrates the host-supplied context surface: context_headers maps reserved-prefix HTTP headers to agent / framework extension fields so APL rules can reference them; context_meta stamps operator-defined scope, tags, and properties onto every policy evaluation
• Policy Http — Generic-HTTP authorization for non-MCP traffic using the Praxis Policy Engine
• Policy Llm — Authorizes body-addressed inference requests against llm: policy routes
• Policy — Embeds the Praxis Policy Engine in-process to enforce multi-source identity, APL route policy, RFC 8693 OAuth 2.0 token exchange, field redaction, session taint, audit emission, and (under body_access: read_write) request / response body rewriting