Shield

1Node.js

Add the middleware before your routes, with the secret key. Behind a proxy or load balancer, set trustProxy to the number of proxies in front of the app. actor returns the account someone is signing in to, so blocked accounts are refused too. Fastify: app.addHook("onRequest", shield.fastify).

import * as Blipit from "@blipit/node";
import express from "express";

const app = express();
app.use(express.json());
app.use(Blipit.shield({ trustProxy: 1, actor: (req) => req.body?.email }));

2Next.js

Wrap your middleware.ts. It runs on the Edge runtime and reads BLIPIT_SECRET_KEY. To keep your own middleware, pass it in: withBlipitShield(yourMiddleware).

import { withBlipitShield } from "@blipit/nextjs/shield";

export const middleware = withBlipitShield();

3Odoo

Nothing to add. From module version 1.18.14, Odoo enforces the same list on every page and on every sign-in once Shield is on.

4How it behaves

• Blocked IPs and accounts get 403 with a short plain-text message; sign-in rate limits answer 429 with Retry-After.
• The list is refreshed every 30 seconds in the background, so a request never waits for Blipit. If Blipit cannot be reached, the last list stays in force.
• In test mode nothing is blocked; Blipit counts what would have been.
• Once a minute your app sends how often each block was hit and, while Shield is on, a small sample of requests: path, method, status, IP, user agent and the query string with secrets removed. Headers, cookies, passwords and request bodies are never sent.