How OmniRoute Guards Against Prompt Injection: Architecture and Configuration

OmniRoute employs a configurable two-layer guardrail system that scans the first 16KB of concatenated prompts using heuristic regex patterns to detect and block, warn, or log potential injection attempts before they reach upstream LLM providers.

Prompt injection attacks represent a critical security vector for LLM applications, attempting to override system instructions through malicious user input. The open-source OmniRoute repository (diegosouzapw/OmniRoute) implements a fail-closed, tunable defense mechanism that inspects every request before it reaches the provider. This article examines the technical implementation of how OmniRoute guards against prompt injection through its middleware architecture, severity classification system, and runtime configuration options.

Two-Layer Guardrail Architecture

OmniRoute’s injection protection operates as a request-side input sanitizer that intercepts traffic before upstream transmission.

The Middleware Scanner

Located in src/middleware/promptInjectionGuard.ts, the guardrail concatenates all user messages and system prompts, then applies heuristic regular-expression checks against the combined payload. The middleware supports four operational modes determined by the INJECTION_GUARD_MODE feature flag:

• block: Returns HTTP 400 with rejection message
• warn: Logs detection without blocking
• off: Passes all traffic without scanning
• redact: Records event only (legacy mode, does not modify payload)

Severity Classification

The detection logic resides in src/shared/utils/injectionSeverity.ts, which categorizes pattern matches into three tiers: low, medium, or high severity. The INPUT_SANITIZER_BLOCK_THRESHOLD environment variable determines which severity level triggers enforcement actions, allowing operators to tune sensitivity based on their risk tolerance.

Runtime Configuration and Feature Flags

OmniRoute supports dynamic reconfiguration without redeployment through its feature-flag system documented in docs/reference/FEATURE_FLAGS.md.

Operators control the guardrail through three environment variables:

export INPUT_SANITIZER_ENABLED=true
export INPUT_SANITIZER_MODE=block        # options: off, warn, block, redact

export INPUT_SANITIZER_BLOCK_THRESHOLD=high   # low | medium | high

These settings can be overridden at runtime via database-persisted flags, enabling immediate response to emerging attack patterns without service interruption.

Performance Safeguards

To prevent resource exhaustion attacks, the scanner implements a hard ceiling on inspection scope. The MAX_INJECTION_SCAN_BYTES constant limits analysis to the first 16KB of the concatenated prompt. This boundary ensures CPU-intensive scanning cannot be exploited through oversized payloads while maintaining effectiveness against injection attempts that typically appear early in prompt structures.

Per-Request Opt-Out Mechanism

Certain use cases—such as advanced RAG pipelines—may intentionally contain injection-like patterns. For these scenarios, OmniRoute allows callers to bypass the guardrail for individual requests by including the header:

x-omniroute-disabled-guardrails: true

This header instructs src/middleware/promptInjectionGuard.ts to skip detection for that specific transaction, providing flexibility without compromising global security posture.

Integration with Downstream Guardrails

The prompt injection guard executes before other security layers, specifically preceding the PII-masking guard in src/lib/guardrails/piiMasker.ts and the vision-bridge guard. This ordering guarantees that malicious system-prompt injections are intercepted prior to any downstream processing or data transformation, ensuring that sensitive information masking occurs only on sanitized content.

When detection triggers in block mode, the middleware returns:

{
  "error": {
    "code": 400,
    "message": "Prompt injection detected – request rejected"
  }
}

Summary

• OmniRoute implements a two-layer defense through middleware scanning and severity classification.
• The system caps inspection at 16KB (MAX_INJECTION_SCAN_BYTES) to prevent DoS attacks.
• Four operational modes (block, warn, off, redact) provide configurable response strategies.
• Runtime configuration via environment variables and database flags enables dynamic adjustment without redeployment.
• Per-request bypass via x-omniroute-disabled-guardrails: true header supports legitimate edge cases.
• Execution occurs before PII masking and other guardrails, ensuring early threat detection.

Frequently Asked Questions

What triggers the prompt injection detection in OmniRoute?

The system concatenates all user messages and system prompts, then applies heuristic regular-expression patterns defined in src/shared/utils/injectionSeverity.ts. Matches are classified as low, medium, or high severity based on the pattern characteristics and context within the first 16KB of the payload.

Can I disable the injection guard for specific requests?

Yes. Send the HTTP header x-omniroute-disabled-guardrails: true with your request. This instructs the middleware in src/middleware/promptInjectionGuard.ts to skip scanning for that transaction, which is useful for RAG implementations or testing scenarios where injection-like patterns are intentional.

How does OmniRoute handle large prompts that might impact scanning performance?

The guardrail implements a safeguard through MAX_INJECTION_SCAN_BYTES, limiting analysis to the first 16KB of the concatenated prompt. This prevents CPU exhaustion from oversized payloads while capturing the majority of real-world injection attempts that appear near the beginning of prompts.

What is the difference between "warn" and "redact" modes in the injection guard?

In warn mode, the system logs the detection event but allows the request to proceed to the LLM provider. In redact mode (legacy), the system records the event without modifying the payload or blocking the request, functioning purely as an audit mechanism without active intervention.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}