Introducing the Arcjet Python SDK beta

1
from arcjet import Mode, detect_bot
2
from fastapi import APIRouter, Request
3
from fastapi.responses import JSONResponse
4

5
from app.arcjet import arcjet_with_rule
6

7
arcjet = arcjet_with_rule(
8
    [
9
        # Shield protects your app from common attacks e.g. SQL injection
10
        detect_bot(
11
            # configured with a list of bots to allow from
12
            # https://arcjet.com/bot-list
13
            allow=[],  # blocks all automated clients
14
            mode=Mode.LIVE,  # will block requests. Use "DRY_RUN" to log only
15
        ),
16
    ]
17
)
18

19
router = APIRouter()
20

21

22
@router.get("/bots", name="Bot protection")
23
async def bots(request: Request):
24
    """
25
    All automated clients will receive a 403 response. `curl` is considered an
26
    automated client by default so you can test it by clicking "Try it out"
27
    below and alternating between testing it in your browser running the `curl`
28
    command from your terminal.
29

30
    Learn more about Arcjet Bot protection in the [Arcjet docs](https://docs.arcjet.com/bot-protection/).
31
    """
32

33
    decision = await arcjet.protect(request)
34

35
    print(decision, flush=True)
36

37
    if decision.is_denied():
38
        if decision.reason.is_bot():
39
            return JSONResponse(
40
                {"message": "No bots allowed"},
41
                status_code=403,
42
            )
43

44
        # If the request was denied for any other reason, return a 403 Forbidden
45
        return JSONResponse(
46
            {"message": "Forbidden"},
47
            status_code=403,
48
        )
49

50
    if decision.is_error():
51
        # Fail open to prevent an Arcjet error from blocking all requests. You
52
        # may want to fail closed if this route is very sensitive
53
        print(f"Arcjet error: {decision.error}", flush=True)
54

55
    return JSONResponse({"message": "Hello world!"})