How to Configure the Prompt Injection Guard for Chat Endpoints in OmniRoute

The prompt injection guard in OmniRoute is configured via the INJECTION_GUARD_MODE environment variable and can be bypassed per-request using the x-omniroute-disabled-guardrails header.

OmniRoute protects its chat-completion routes with a Prompt-Injection Guard that inspects the request body before it reaches the LLM provider. The guard is implemented as a Next.js middleware (withInjectionGuard) which wraps each chat-related API route. Understanding how to configure this guard lets you balance security enforcement with operational flexibility.

Middleware Architecture

OmniRoute’s defense layer is built around a middleware pattern that intercepts traffic at the route level. Every chat-type endpoint imports withInjectionGuard and passes its handler to the wrapper, which parses the JSON body once, runs the security check, and either blocks the request with a 400 response or forwards the parsed payload downstream.

Core Guard Implementation

The withInjectionGuard middleware lives in src/middleware/promptInjectionGuard.ts. This wrapper handles request parsing and orchestrates the decision flow:

// src/app/api/v1/chat/completions/route.ts
import { withInjectionGuard } from "@/middleware/promptInjectionGuard";

export const POST = withInjectionGuard(async (request, _ctx, preParsedBody) => {
  // `preParsedBody` is the JSON payload already inspected by the guard.
  return await handleChat(request, null, preParsedBody);
});

Detection Logic

createInjectionGuard delegates to evaluatePromptInjection, found in src/lib/guardrails/promptInjection.ts. This function runs the detection heuristics and decides whether to block, warn, or redact based on the feature flag INJECTION_GUARD_MODE:

// src/lib/guardrails/promptInjection.ts (simplified)
import { evaluatePromptInjection } from "@/lib/guardrails/promptInjection";

export function createInjectionGuard(opts = {}) {
  return (body) => {
    const decision = evaluatePromptInjection(body, opts, {
      disabledGuardrails: resolveDisabledGuardrails({ body }),
      log: opts.logger || console,
    });
    return { blocked: decision.blocked, result: decision.result };
  };
}

Configuration Options

The guard’s behavior is controlled by an enum flag with four modes: off, warn, block, and redact.

Global Environment Variables

Set the guard’s mode globally via the INJECTION_GUARD_MODE variable defined in src/shared/constants/featureFlagDefinitions.ts:

# .env

INJECTION_GUARD_MODE=warn   # options: off | warn | block | redact

• off: Disables the guard entirely.
• warn: Allows the request and adds the response header X-Injection-Flagged: true when suspicious content is detected.
• block: Returns a 400 error immediately if injection patterns are detected.
• redact: Sanitizes the payload while allowing the request to continue to the LLM provider.

Per-Request Overrides

Override the global setting for a single request by including the x-omniroute-disabled-guardrails header. This is useful for testing or when a legitimate use case triggers false positives:

POST /v1/chat/completions HTTP/1.1
Content-Type: application/json
x-omniroute-disabled-guardrails: true

{
  "model": "gpt-4o",
  "messages": [{ "role": "user", "content": "Hello" }]
}

Activation Across Chat Endpoints

The guard is automatically applied wherever withInjectionGuard is imported. According to the OmniRoute source code, this includes all chat-related routes such as /v1/chat/completions, /v1/embeddings, /v1/images/edits, and others. Each endpoint file imports the same middleware, ensuring consistent protection across the API surface.

Key files involved in the protection chain:

• src/middleware/promptInjectionGuard.ts: Core middleware that parses requests and blocks or forwards them.
• src/lib/guardrails/promptInjection.ts: Implements evaluatePromptInjection and detection heuristics.
• src/shared/constants/featureFlagDefinitions.ts: Defines the INJECTION_GUARD_MODE flag and valid values.
• src/app/api/v1/chat/completions/route.ts: Primary example of a protected endpoint.

Summary

• Configure the prompt injection guard globally using the INJECTION_GUARD_MODE environment variable with values off, warn, block, or redact.
• The guard runs as Next.js middleware (withInjectionGuard) in src/middleware/promptInjectionGuard.ts, wrapping handlers in chat endpoints.
• Detection logic resides in evaluatePromptInjection within src/lib/guardrails/promptInjection.ts.
• Bypass the guard for individual requests by sending the x-omniroute-disabled-guardrails: true header.
• All chat-type routes including /v1/chat/completions and /v1/embeddings automatically inherit this protection when they import the middleware wrapper.

Frequently Asked Questions

What is the default mode if I do not set INJECTION_GUARD_MODE?

If the environment variable is undefined, the guard typically defaults to off or inherits a safe fallback defined in the feature flag registry at src/shared/constants/featureFlagDefinitions.ts. Always explicitly set this variable in production to ensure predictable security behavior.

How do I completely disable the guard for a specific API call?

Send the x-omniroute-disabled-guardrails: true header with your request. This header is resolved by resolveDisabledGuardrails inside the guard logic and causes the evaluation to skip detection heuristics for that single transaction.

What is the difference between warn and redact modes?

Warn allows the request to reach the LLM provider but flags the response with X-Injection-Flagged: true so downstream logging systems can audit the event. Redact modifies the payload content to remove or mask suspicious patterns before forwarding, preventing leakage without rejecting the request entirely.

Which chat endpoints are protected by default?

According to the OmniRoute source code, any route that imports withInjectionGuard is protected. This includes src/app/api/v1/chat/completions/route.ts, embedding endpoints, image editing routes, and other chat-type handlers under src/app/api/v1/*/. Check individual route files to confirm middleware usage.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}