Repository navigation
feat: add PureASGISecurityMiddleware (pure-ASGI variant, no BaseHTTPMiddleware) - #156
Merged
Merged
Conversation
…iddleware) Runs the same screening pipeline as SecurityMiddleware (init, CORS preflight, exclusions, IP extraction, bans, rate limiting, UA blocking, penetration detection, behavioral usage rules) without wrapping the downstream app in an anyio task group, so client disconnects can never cancel in-flight downstream calls. Security and CORS headers are injected on http.response.start; responses stream through unbuffered. Decorator-driven response rules (return patterns) and custom_response_modifier remain BaseHTTPMiddleware-path features.
github-actions
Bot
added
area: integrations
This was referenced Oct 10, 2026
… update Covers chunked-body caching and replay, disconnect passthrough, CORS on both success and blocked responses, guard-redis 503 path, decorator bypass via the buffered call path, and behavioral usage rules.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #157
What
Adds
PureASGISecurityMiddleware: a pure-ASGI variant ofSecurityMiddlewarethat runs the identical screening pipeline (init, CORS preflight, exclusions, IP extraction, bans, rate limiting, UA blocking, penetration detection, behavioral usage rules) withoutBaseHTTPMiddleware.Why
BaseHTTPMiddlewarewraps the downstream app in an anyio task group whose cancel scope cancels in-flight downstream awaits on client disconnect. Framework projects ban it for exactly that reason (open-webui bans it in main.py with a written rationale), which locks them out of guard entirely. This variant removes the blocker: no task group, downstream awaits are never cancelled by guard, responses stream through unbuffered.How
guard/asgi.py:PureASGISecurityMiddlewarereuses the classic middleware as its engine (constructor builds pipeline, handlers, rate limiter, event bus, CORS handler - no duplication) and replicates the dispatch flow on raw ASGI: body reads go through a caching receive that replays to the downstream app, security + CORS headers are injected directly onhttp.response.start, WebSocket/lifespan scopes pass through untouchedcustom_response_modifierneed a materializedResponseand remainBaseHTTPMiddleware-path features (documented in the module docstring)guardalongsideSecurityMiddleware; classic middleware unchangedmake_guard_websocketas todayValidation
tests/test_asgi_pure.py(8 tests): blocked IP 403, rate limit 200/200/429, passive mode, IP lists enforced on excluded paths, rate limiting also enforced on excluded paths (by design), security headers injected on the ASGI response start, body read by guard and still received downstream, non-http scope passthrough