Request Pipeline

Detects whether the request arrived via a custom domain or subdomain pattern (e.g. slug-id6.edgewrap.pro). Extracts the project slug and rewrites the URL path for routing.

Reads x-api-key from request headers. SHA-256 hashes the key and looks up the project context in the fast local cache with database fallback. Validates the key is active and not expired.

Validates the request origin (Referer or client platform headers) against the API key's allowed platforms (web, mobile, desktop, server). Server keys also verify x-api-secret.

Evaluates the three-tier quota bucket: Free → Plan → PAYG. Reads real-time counters from the edge database cache. If the PAYG spend cap is breached, the request is blocked.

Checks the client IP against a high-speed sliding-window rate counter at the edge. If RPS exceeds the plan threshold within the configured window, the request is challenged or blocked.

Runs OWASP rule sets against the request (SQL injection, XSS, RCE, LFI, scanner detection). Checks IP/country/user-agent blocklists. On Pro+ runs AI anomaly detection and prompt injection shield.

Evaluates behavioural signals (headless browser fingerprints, challenge results, request cadence) to assign a bot score (0–100). Requests above the configured threshold are blocked.

Scans request body and headers for PII, API keys, and secrets using regex patterns. Detected secrets are redacted before forwarding to origin. A violation event is logged.

Computes the cache key and queries the edge cache. Returns a HIT immediately. On MISS, checks stale-while-revalidate window. Bypasses cache for non-GET methods, bypass rules, or bypass headers.

Selects the target origin URL. Checks geo-residency rules first, then load-balancer pool (if configured), then falls back to the project's default originUrl.

Queries the circuit breaker state for the selected origin. If OPEN, checks for a stale cache response to serve. If no stale response is available, returns 503.

Executes the origin request with retry logic and failover. On timeout or 5xx, retries up to maxRetries times with exponential backoff. Updates circuit breaker status on failure.

Scans response body for secrets and PII. Redacts matches before forwarding to client. Also applies GDPR data masking rules if configured.

Writes the response to edge cache with the computed TTL. Applies stale-while-revalidate metadata. Cache write is asynchronous and does not delay the response.

Asynchronously logs a structured analytics event containing request metadata, latency, cache status, WAF result, bot score, and billing bucket classification.