# How to Configure the Prompt Injection Guard for Chat Endpoints in OmniRoute

> Configure the prompt injection guard for chat endpoints in OmniRoute using the INJECTION_GUARD_MODE env var. Learn how to bypass per-request with the x-omniroute-disabled-guardrails header.

- Repository: [Diego Rodrigues de Sa e Souza/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
- Tags: how-to-guide
- Published: 2026-08-01

---

**The prompt injection guard in OmniRoute is configured via the `INJECTION_GUARD_MODE` environment variable and can be bypassed per-request using the `x-omniroute-disabled-guardrails` header.**

OmniRoute protects its chat-completion routes with a **Prompt-Injection Guard** that inspects the request body before it reaches the LLM provider. The guard is implemented as a Next.js middleware (`withInjectionGuard`) which wraps each chat-related API route. Understanding how to configure this guard lets you balance security enforcement with operational flexibility.

## Middleware Architecture

OmniRoute’s defense layer is built around a middleware pattern that intercepts traffic at the route level. Every chat-type endpoint imports `withInjectionGuard` and passes its handler to the wrapper, which parses the JSON body once, runs the security check, and either blocks the request with a 400 response or forwards the parsed payload downstream.

### Core Guard Implementation

The `withInjectionGuard` middleware lives in [`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts). This wrapper handles request parsing and orchestrates the decision flow:

```ts
// src/app/api/v1/chat/completions/route.ts
import { withInjectionGuard } from "@/middleware/promptInjectionGuard";

export const POST = withInjectionGuard(async (request, _ctx, preParsedBody) => {
  // `preParsedBody` is the JSON payload already inspected by the guard.
  return await handleChat(request, null, preParsedBody);
});

```

### Detection Logic

`createInjectionGuard` delegates to `evaluatePromptInjection`, found in [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts). This function runs the detection heuristics and decides whether to block, warn, or redact based on the feature flag `INJECTION_GUARD_MODE`:

```ts
// src/lib/guardrails/promptInjection.ts (simplified)
import { evaluatePromptInjection } from "@/lib/guardrails/promptInjection";

export function createInjectionGuard(opts = {}) {
  return (body) => {
    const decision = evaluatePromptInjection(body, opts, {
      disabledGuardrails: resolveDisabledGuardrails({ body }),
      log: opts.logger || console,
    });
    return { blocked: decision.blocked, result: decision.result };
  };
}

```

## Configuration Options

The guard’s behavior is controlled by an enum flag with four modes: `off`, `warn`, `block`, and `redact`.

### Global Environment Variables

Set the guard’s mode globally via the `INJECTION_GUARD_MODE` variable defined in [`src/shared/constants/featureFlagDefinitions.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/constants/featureFlagDefinitions.ts):

```bash

# .env

INJECTION_GUARD_MODE=warn   # options: off | warn | block | redact

```

- **`off`**: Disables the guard entirely.
- **`warn`**: Allows the request and adds the response header `X-Injection-Flagged: true` when suspicious content is detected.
- **`block`**: Returns a 400 error immediately if injection patterns are detected.
- **`redact`**: Sanitizes the payload while allowing the request to continue to the LLM provider.

### Per-Request Overrides

Override the global setting for a single request by including the `x-omniroute-disabled-guardrails` header. This is useful for testing or when a legitimate use case triggers false positives:

```http
POST /v1/chat/completions HTTP/1.1
Content-Type: application/json
x-omniroute-disabled-guardrails: true

{
  "model": "gpt-4o",
  "messages": [{ "role": "user", "content": "Hello" }]
}

```

## Activation Across Chat Endpoints

The guard is automatically applied wherever `withInjectionGuard` is imported. According to the OmniRoute source code, this includes all chat-related routes such as `/v1/chat/completions`, `/v1/embeddings`, `/v1/images/edits`, and others. Each endpoint file imports the same middleware, ensuring consistent protection across the API surface.

Key files involved in the protection chain:

- **src/middleware/promptInjectionGuard.ts**: Core middleware that parses requests and blocks or forwards them.
- **src/lib/guardrails/promptInjection.ts**: Implements `evaluatePromptInjection` and detection heuristics.
- **src/shared/constants/featureFlagDefinitions.ts**: Defines the `INJECTION_GUARD_MODE` flag and valid values.
- **src/app/api/v1/chat/completions/route.ts**: Primary example of a protected endpoint.

## Summary

- Configure the **prompt injection guard** globally using the `INJECTION_GUARD_MODE` environment variable with values `off`, `warn`, `block`, or `redact`.
- The guard runs as **Next.js middleware** (`withInjectionGuard`) in [`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts), wrapping handlers in chat endpoints.
- Detection logic resides in `evaluatePromptInjection` within [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts).
- Bypass the guard for individual requests by sending the `x-omniroute-disabled-guardrails: true` header.
- All chat-type routes including `/v1/chat/completions` and `/v1/embeddings` automatically inherit this protection when they import the middleware wrapper.

## Frequently Asked Questions

### What is the default mode if I do not set INJECTION_GUARD_MODE?

If the environment variable is undefined, the guard typically defaults to `off` or inherits a safe fallback defined in the feature flag registry at [`src/shared/constants/featureFlagDefinitions.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/constants/featureFlagDefinitions.ts). Always explicitly set this variable in production to ensure predictable security behavior.

### How do I completely disable the guard for a specific API call?

Send the `x-omniroute-disabled-guardrails: true` header with your request. This header is resolved by `resolveDisabledGuardrails` inside the guard logic and causes the evaluation to skip detection heuristics for that single transaction.

### What is the difference between warn and redact modes?

**Warn** allows the request to reach the LLM provider but flags the response with `X-Injection-Flagged: true` so downstream logging systems can audit the event. **Redact** modifies the payload content to remove or mask suspicious patterns before forwarding, preventing leakage without rejecting the request entirely.

### Which chat endpoints are protected by default?

According to the OmniRoute source code, any route that imports `withInjectionGuard` is protected. This includes [`src/app/api/v1/chat/completions/route.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/app/api/v1/chat/completions/route.ts), embedding endpoints, image editing routes, and other chat-type handlers under `src/app/api/v1/*/`. Check individual route files to confirm middleware usage.