AutoRAG is an open-source framework designed for evaluation, demonstration, and rapid deployment. By default, the framework runs in a permissive mode to facilitate:

• Easy evaluation and testing
• Quick proof-of-concept deployments
• Cross-domain demonstrations
• Development and debugging

Out of the box, the framework operates with these defaults:

For production deployments, you can enable security features via environment variables:

# Restrict to specific origins (comma-separated)
ALLOWED_ORIGINS=https://example.com,https://app.example.com

When set, only listed origins can access the API. Requests from other origins will be blocked.

# Enable rate limiting
ENABLE_RATE_LIMITING=true

# Configure limits (optional)
RATE_LIMIT_WINDOW_MS=60000    # Time window in ms (default: 60000 = 1 minute)
RATE_LIMIT_MAX_REQUESTS=120   # Max requests per window (default: 120)

Prevents abuse by limiting requests per client.

# Enable strict CSP headers
ENABLE_STRICT_CSP=true

When enabled:

• Restricts resource loading to same-origin and trusted CDNs
• Prevents clickjacking with X-Frame-Options: DENY
• Enables HSTS for HTTPS enforcement
• Sets strict Permissions Policy

# Configure max request size in KB (default: 100)
MAX_REQUEST_SIZE_KB=50

Prevents DoS attacks via large payloads. This is always enabled for stability.

# No security variables needed - defaults are permissive

# Light security for public demos
ENABLE_RATE_LIMITING=true
RATE_LIMIT_MAX_REQUESTS=200

# Moderate security for internal applications
ALLOWED_ORIGINS=https://internal.company.com
ENABLE_RATE_LIMITING=true
RATE_LIMIT_MAX_REQUESTS=100

# Maximum security for public applications
ALLOWED_ORIGINS=https://app.example.com,https://www.example.com
ENABLE_RATE_LIMITING=true
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_MAX_REQUESTS=60
ENABLE_STRICT_CSP=true
MAX_REQUEST_SIZE_KB=50

The R2 browser (/r2/* endpoints) provides full CRUD operations including DELETE. This is intentional for framework evaluation:

• Development: Full access for testing document management
• Production: Consider implementing authentication or disabling these endpoints

To disable R2 browser in production, remove the routes from worker/src/index.ts.

These features are always enabled regardless of configuration:

1. Input Sanitization: All user inputs are sanitized to prevent XSS
2. Request Size Check: Prevents memory exhaustion (configurable limit)
3. Basic Security Headers: X-Content-Type-Options, X-XSS-Protection
4. Error Message Sanitization: Internal errors never exposed to clients

• Set ALLOWED_ORIGINS to your specific domains
• Enable rate limiting with ENABLE_RATE_LIMITING=true
• Enable strict CSP with ENABLE_STRICT_CSP=true
• Review and adjust rate limits for your use case
• Consider implementing authentication for R2 browser
• Set up monitoring and alerting for security events
• Regular security audits and dependency updates
• Use HTTPS exclusively (enforced by Cloudflare Workers)

Remember: AutoRAG is a framework, not a production application. The permissive defaults are intentional to support:

• Rapid prototyping
• Cross-team collaboration
• Demo deployments
• Educational use
• Open-source contribution

When deploying to production, review this guide and enable appropriate security features for your use case.

This is an open-source project. For security concerns:

1. Review the code - it's all open source
2. Enable the security features you need
3. Contribute improvements back to the community
4. Fork and customize for your specific requirements