Abuse Protection
Compose bot, credential, email, GeoIP, and IP reputation controls explicitly.
effect-auth separates provider facts, endpoint/domain policy, and authentication decisions. Installing Turnstile, HIBP, or IPQualityScore does not silently change a flow.
| Concern | Guide | Policy seam |
|---|---|---|
| Browser challenge | Bot Protection | Endpoint-local request guard |
| Breached password | Password and Email Risk | Credential mutation |
| Disposable/blocked email | Password and Email Risk | Signup and identity mutation |
| GeoIP/IP reputation | GeoIP and IP Reputation | Login-risk engine |
Bot Protection here means the provider-neutral challenge port and first-party Turnstile adapter. It does not configure Cloudflare WAF or Bot Management.
Choose a guide
Adopt only the control required by the flow; each guide keeps provider facts and product decisions separate.
Defaults are explicit
| Layer | Behavior | Provider required |
|---|---|---|
BotProtection.noopLayer | Bypasses enforcement | No |
BotProtectionPolicy.defaultLayer | Selects Skip | No |
AbuseProtection.layerNoDeps | Enforces the selected bot policy | BotProtectionPolicy and BotChallengeVerifier |
PasswordRiskPolicy.noopLayer | Accepts password | No |
PasswordRiskPolicy.make | Explicit threshold/outage mode | BreachedPasswordProvider |
EmailAcceptancePolicy.noopLayer | Accepts email | No |
EmailRisk.layerNoDeps(options) | Applies the configured email policy | EmailReputation |
Do not infer strictness from a recipe name. Build and test the production policy explicitly.
Shared principles
- Decode, validate origin, and rate-limit before remote calls where the chosen HTTP guard guarantees that order.
- Direct domain calls and alternate transports must recreate their own request ordering.
- Bind provider secrets through Alchemy
Config.redacted; keep D1, Durable Object, and secret bindings on the private auth Worker. - Treat proofs, IPs, user agents, passwords, provider payloads, and API keys as sensitive transient data.
- Persist bounded purpose-specific facts, never complete request or provider payloads.
- Choose fail-open/closed behavior per dependency and distinguish invalid proof from retryable outage.
- Return generic public errors; retain typed provider diagnostics only in redacted server telemetry.
For a Cloudflare signup, a practical order is: same-origin request, origin check, Durable Object rate limit, optional Turnstile, email acceptance, password risk, then atomic registration. Test short-circuiting at every stage.
Continue with Security Policies, Custom Auth API, and Testing.