Honeypot Tarpit

The Honeypot Tarpit is a built-in security layer designed to instantly neutralize connections from malicious botnets, reconnaissance scanners, and automated exploit frameworks. It operates at the earliest phase of the request handling lifecycle to save CPU cycles.

Enable / Disable

By default, the Honeypot Tarpit is enabled. You can explicitly disable it in your server configuration if you need to capture malicious requests in your application layer.

import { createServer } from "xypriss";

const app = createServer({
    security: {
        honeypotTarpit: false, // Set to false to disable the tarpit
    },
});

The 6-Stage Pipeline

The Tarpit applies a zero-false-positive strategy using a deterministic pipeline before any expensive routing or session management occurs:

Why 403 Forbidden?

XyPriss uses a lightweight 403 Forbidden response instead of tearing down the TCP socket. This avoids penalizing legitimate requests that might be multiplexed over the same Keep-Alive connection in reverse proxy or XHSC bridge environments.