Skip to main content

Integrate RequestShield in the browser

If you are new to RequestShield, start with the Introduction.

RequestShield Browser SDK obtains a short-lived token for selected browser requests. The application backend performs the allow-or-block decision based on this token.

Integrating RequestShield requires two steps:

  1. The client application obtains a token and transmits the returned value with the protected request.
  2. The application backend verifies the token with a RequestShield Backend SDK before processing the request.

This guide covers the browser integration. For server-side setup, see Verify RequestShield tokens with Java.

Prerequisites​

  • An App Key supplied by IntelliFend.
  • Access to the HTML and JavaScript for the page that initiates protected requests.
  • A backend route configured to verify RequestShield tokens.

1. Add the RequestShield script​

Include the hosted script once in the <head> of each page that obtains tokens:

<script
  src="https://static.intellifend.ai/requestshield/v1.0.0/intellifend.js"
  data-app-key="YOUR_APP_KEY"
  defer
></script>
AttributeRequiredDescription
srcYesThe production RequestShield Browser SDK URL.
data-app-keyYesPublic App Key supplied by IntelliFend.
deferRecommendedLoads the script without blocking HTML parsing.

The script initializes automatically with the value in data-app-key.

Optional Subresource Integrity (SRI)​

The RequestShield Browser SDK supports SRI. SHA-384 integrity values are published for every version in its versioned checksums.json file.

2. Protect a request​

Invoke IntelliFend.getToken() immediately prior to issuing each protected request and forward the returned value in the X-IntelliFend-Token header:

async function submitCheckout(checkout) {
  const token = await IntelliFend.getToken();

  return fetch('/checkout', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-IntelliFend-Token': token,
    },
    body: JSON.stringify(checkout),
  });
}

Forward the returned string unmodified, including "". The Backend SDK handles the value and returns the verification decision; client-side code must not perform access control or mitigation logic.

important

Server-side verification is required. The application backend must enforce the result from the RequestShield Backend SDK before processing the protected operation.

Browser SDK API​

The hosted script exposes window.IntelliFend:

interface IntelliFendApi {
  init(config: InitConfig): void;
  getToken(options?: GetTokenOptions): Promise<string>;
  version: string;
}

init(config)​

Explicit initialization is available when application configuration is supplied in JavaScript. Script-tag integrations normally use automatic initialization.

IntelliFend.init({
  appKey: 'YOUR_APP_KEY',
  timeoutMs: 4000,
});
PropertyTypeRequiredDefaultDescription
appKeystringYesNonePublic App Key supplied by IntelliFend.
timeoutMsnumberNo5000Maximum time, in milliseconds, to obtain a token.

Invalid configuration throws an IntelliFendError with code invalid_config.

getToken(options?)​

Requests a fresh token for one protected request.

IntelliFend.getToken(options?: GetTokenOptions): Promise<string>
OptionTypeRequiredDefaultDescription
actionstringNoOmittedOptional, case-sensitive label for the protected operation, such as login or checkout.
timeoutMsnumberNoInitialized timeoutMaximum time for the token request. It can shorten, but not extend, the initialized timeout.
signalAbortSignalNoNoneCancels this token request.

getToken() always resolves to a string and never rejects. The resolved value must be forwarded unchanged for backend verification.

version​

IntelliFend.version contains the loaded Browser SDK version. Use it for support diagnostics only.

Optional action metadata​

The optional action parameter associates a token with a specific protected operation:

const token = await IntelliFend.getToken({action: 'checkout'});

Action metadata is not authorization by itself. The application backend continues to use verify(token) as the enforcement decision.

Content Security Policy​

For applications enforcing Content Security Policy (CSP), merge these sources into the existing policy:

Content-Security-Policy:
  script-src 'self' https://static.intellifend.ai;
  connect-src 'self' https://challenge.intellifend.ai;
  worker-src 'self' blob:;

Applications that do not enforce CSP require no additional header configuration.

Security requirements​

  • Obtain a fresh token for every protected request, including retries.
  • Forward the exact value returned by getToken(), including "".
  • Access control and mitigation logic must execute only in the backend.
  • Exclude tokens from client-side caching, persistence, inspection, and transformation.
  • Exclude tokens from URL paths, query parameters, or URI fragments.
  • Exclude X-IntelliFend-Token from logs, analytics, and error reports.