RouteWardenHigh-Performance Traefik Middleware

What is RouteWarden? ​

RouteWarden is an ultra-fast, zero-dependency Traefik middleware plugin built in pure Go. It acts as an in-line security shield deployed at your edge router or ingress controller, safeguarding downstream microservices and web applications from reconnaissance probing, accidental sensitive data exposure, and path evasion attacks.

Every internet-connected IP is continuously bombarded by automated crawlers, Shodan/Censys scanners, and credential-harvesting bots searching for .env files, .git credential databases, database backups, admin consoles, and leaked cloud credentials. RouteWarden intercepts and neutralizes these probing attempts at the Traefik proxy layer before they ever hit your upstream containers or touch your backend logs.

Request Inspection Lifecycle ​

RouteWarden evaluates every inbound HTTP request across four deterministic security stages:

Common Attack Vectors Blocked Out-of-the-Box ​

Without requiring any custom regex rules, RouteWarden's enableDefaultPatterns: true guards against the most critical OWASP information disclosure vulnerabilities:

Anti-Evasion Capabilities ​

Attackers frequently encode paths or use reverse-proxy edge cases to evade simple string-matching rules. RouteWarden eliminates these evasion vectors before matching:

Flexible Response Engines ​

When a sensitive route is intercepted, you decide how Traefik responds to the client:

• json: Return clean JSON payloads with customizable status codes (e.g. 403 Forbidden or 404 Not Found) and custom error messages.
• html: Render branded warning or company error pages with embedded styling.
• text: Emit lightweight plain-text error messages.
• xml: Output standard XML formatted error bodies (<Error><Status>403</Status>...</Error>) for SOAP and enterprise services.
• captcha: Present human verification challenges using Cloudflare Turnstile, hCaptcha, or Google reCAPTCHA without needing any backend captcha server.
• redirect: Silently deflect attackers to an external honeypot, logging sink, or warning site.
• silentDrop: Close the TCP connection immediately without emitting any response payload to confuse automated port scanners.
• gzipBomb (alias: bomb): Stream compressed zero-byte blocks that expand ~1000× (e.g. 10 MB expands to ~10 GB in client RAM) with negligible server bandwidth, forcing memory exhaustion (OOM) on vulnerability crawlers (nikto, gobuster, dirsearch).
• tarpit: Reverse Slowloris defense that trickles individual bytes at slow intervals to tie up scanner socket pools and concurrency workers for minutes.
• fakeSuccess (alias: decoy): Return realistic synthetic honeypot data (.env credentials, mock Spring Actuator metrics, dummy git/HEAD, fake wp-login) to fool attackers and log early warning telemetry.
• rateLimitChallenge (alias: ratelimit): Issue an HTTP 429 Too Many Requests with a compliant Retry-After header to force automated scrapers to back off.
• proxy (alias: mirror): Transparently reverse-proxy probing traffic to an internal forensics/canary container without tipping off the attacker with a 302 redirect.
• infiniteStream (alias: garbagestream): Stream endless chunks of pseudo-random data to fill client disks and crash parsing buffers.

60-Second Quickstart ​

Get RouteWarden running on your Traefik instance in under a minute:

# dynamic_conf.yml
http:
  middlewares:
    global-warden:
      plugin:
        routewarden:
          enabled: true
          enableDefaultPatterns: true
          # Optional custom regex patterns to guard
          pathPatterns:
            - '(?i)^/admin(/.*)?$'
            - '(?i)^/api/internal(/.*)?$'
          # Safe exceptions (always allowed)
          allowPatterns:
            - '(?i)^/api/internal/health$'
            - '(?i)^/robots\.txt$'
          # Whitelisted VPN or office IPs
          allowedIps:
            - "10.0.0.0/8"
            - "192.168.1.100"
          # Response configuration
          response:
            mode: json
            statusCode: 404
            body: '{"error":"Not Found","message":"The requested resource does not exist"}'

  routers:
    app-router:
      rule: "Host(`example.com`)"
      entryPoints:
        - web
      middlewares:
        - global-warden
      service: app-service

# dynamic_conf.toml
[http.routers.app-router]
  rule = "Host(`example.com`)"
  entryPoints = ["web"]
  middlewares = ["global-warden"]
  service = "app-service"

[http.middlewares.global-warden.plugin.routewarden]
  enabled = true
  enableDefaultPatterns = true
  pathPatterns = ["(?i)^/admin(/.*)?$", "(?i)^/api/internal(/.*)?$"]
  allowPatterns = ["(?i)^/api/internal/health$", "(?i)^/robots\\.txt$"]
  allowedIps = ["10.0.0.0/8", "192.168.1.100"]

[http.middlewares.global-warden.plugin.routewarden.response]
  mode = "json"
  statusCode = 404
  body = '{"error":"Not Found","message":"The requested resource does not exist"}'

# Docker Compose Labels / CLI equivalent
- "traefik.http.middlewares.global-warden.plugin.routewarden.enabled=true"
- "traefik.http.middlewares.global-warden.plugin.routewarden.enableDefaultPatterns=true"
- "traefik.http.middlewares.global-warden.plugin.routewarden.pathPatterns=(?i)^/admin(/.*)?$,(?i)^/api/internal(/.*)?$"
- "traefik.http.middlewares.global-warden.plugin.routewarden.allowPatterns=(?i)^/api/internal/health$,(?i)^/robots\\.txt$"
- "traefik.http.middlewares.global-warden.plugin.routewarden.allowedIps=10.0.0.0/8,192.168.1.100"
- "traefik.http.middlewares.global-warden.plugin.routewarden.response.mode=json"
- "traefik.http.middlewares.global-warden.plugin.routewarden.response.statusCode=404"
- 'traefik.http.middlewares.global-warden.plugin.routewarden.response.body={"error":"Not Found","message":"The requested resource does not exist"}'

Production Case Studies ​

Real-world deployment patterns demonstrating how engineering teams and self-hosters protect their applications using RouteWarden:

Ready to Explore? ​

• Check out the Getting Started Guide for step-by-step installation instructions.
• Learn about the System Architecture and how RouteWarden processes requests.
• Explore the Examples Cookbook for Docker Compose and Kubernetes manifests.
• Browse all Production Case Studies for practical production blueprints.
• Read the Anti-Evasion Security Deep Dive for security test results.