Skip to content
A line of defense for your Vapor application including attack filtering + extras.
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.



A line of defense for your Vapor application including attack filtering + extras.

Why use it?

Moat provides middleware, custom Leaf tags and string extensions to examine and block requests based on origin and referer headers, filter for src and href attribute XSS attacks, protecting unencoded HTML with esoteric XSS techniques, censoring profanity, and allowing for pure unchanged HTML.

Moat should be used alongside other protections such as CSRF tokens and a strong Content Security Policy (CSP) policy. A CSP policy gives directives to the browser to what and from where certain resources can be loaded from the page containing the CSP header. Please see the vapor-community/CSRF and brokenhandsio/VaporSecurityHeaders libraries to add CSRF tokens and security headers to your Vapor application.

For more information on Vapor application security please visit Broken Hands' Security And Your Vapor Application article.

Filters will be updated regularly to protect against the latest attacks.


Add Moat to your Package.swift

dependencies: [
   .package(url: "", from: "0.0.6")

Cross-Site Request Forgery (CSRF) Filters


The OriginCheckMiddleware helps protect against Cross-Site Request Forgery (CSRF) attacks by examining incoming Origin and/or Referer headers and blocking POST requests that do not come from a list of approved origins or referring pages. Origin and/or referer headers may not be present in all requests. You can choose to fail open, if origin or referrer headers are omitted, to balance security and functionality, or fail close if you require a higher level of security and/or no other CSRF mitigations are implemented in your application.

  1. Set origin and referer to the intended origin(s) and referer(s).
    • Example origin: origin: ""
    • Example referer: referer: "" (/ is important)
  2. Decide if headers are not present to failopen or failclosed
    • Example: failopen: True

Other options:
- Set status to HTTPResponseStatus
- Set reason to error string

- origin: [String] or String
- referer: [String] or String
- failopen: Bool (default = True)
- status: HTTPResponseStatus (default = .badRequest)
- reason: String (default = "Origin check failed.")


If you would like you use the filtering on all POST requests, set up the OriginCheckMiddleware in your configure.swift file.

   var middlewareConfig = MiddlewareConfig()
    let origins = ["", ""]
   let refers = ["", ""]
    middlewareConfig.use(OriginCheckMiddleware(origin: origins, referer: refers, failopen: true))
Route Groups

If you would like the middleware applied to certain routes you can use route groups.

    let origin = ""
    let referer = ""
    let moat = router.grouped(OriginCheckMiddleware(origin: origin, referer: referer))"...")

Cross-Site Scripting (XSS) Filters


Protects src or href attributes from XSS attacks. For example the payload javascript:alert('Vapor') or data:text/html;base64,PHNjcmlwdD5hbGVydCgnVmFwb3InKTwvc2NyaXB0Pg== are not escaped via templating engines or HTML encoding. These should be protected when embedded in src, href or data attributes (<a href=“javascript:alert('Vapor')”>XSS</a>). For example javascript:alert(1) becomes the non-exploitable javascriptalert(1).


Provides XSS protection to raw HTML strings whether via custom Leaf tag or strings. For example <img src=x onerror="alert(1)"> becomes the safe <img src=x ="alert(1)">
Note: Not all XSS attacks are mitigated as content is not HTML escaped.

Other filters


Provides a customizable array to censor words or dictionary to replace words with alternatives. For example fudge into ***** or damn into dang.

¯\(ツ)/¯ (shrug)

Allows for raw unescaped, unfiltered and unprotected HTML to be passed to Leaf. For example the XSS exploit <script>alert(1)</script> is unprotected and not HTML encoded or filtered.


  • Use the #src(string) or #href(string) in Leaf
  • Use the #html(string) in Leaf
  • Use string.xssFilter() on strings
  • Use the #clean(string) in Leaf
  • Use string.profanityFilter() on strings
¯\(ツ)/¯ (shrug)
  • Use the #shrug(string) in Leaf
Add Leaf tags to your configure.swift
    var tags = LeafTagConfig.default()
    tags.use(ProfanityTag(), as: "clean")
    tags.use(SrcTag(), as: "src")
    tags.use(SrcTag(), as: "href")
    tags.use(HtmlTag(), as: "html")
    tags.use(ShrugTag(), as: "shrug") // ¯\_(ツ)_/¯

The Filter.swift contains a customizable list of filters:ProtanityFilter, XSSFilter, SrcFilter, and HtmlEncodeFilter. They each contain an array (filterArray) and a dictionary (filterDict). Items in the array will be removed when filters, while the dictionary keys will be replaced with it's corresponding value.



You can’t perform that action at this time.