How to Detect Suspicious HTTP Requests in Node.js Using Risk Scoring

Every Node.js application eventually faces automated traffic — bots, scanners, scripted curl requests, and random hits on sensitive routes like /login or /admin. The real challenge is deciding what to do with this traffic without blocking genuine users or violating privacy.

The Problem: Traditional Bot Detection Doesn’t Scale Well

Most developers try to solve this problem by classifying traffic as either human or bot. In practice, this approach causes multiple issues. User-Agent strings can be spoofed, headless browsers behave like real users, and strict blocking rules often affect legitimate users or search engine crawlers. Fingerprinting-based solutions also raise privacy concerns.

The Solution: Risk-Based Request Scoring

Instead of making a binary decision, a better approach is to assign a risk score to each request. Risk scoring focuses on probability rather than certainty. Each request is evaluated using simple, explainable signals, and the application decides how to respond based on the overall risk.

Introducing request-risk-score

request-risk-score is a lightweight, open-source Node.js package that analyzes HTTP requests and returns a risk score between 0 and 100. It is designed to work without browser fingerprinting, tracking scripts, or external APIs, making it suitable for privacy-conscious applications.

How the Package Works

The package evaluates common indicators of automated traffic such as missing browser headers, tool-based User-Agents (for example, curl), access to sensitive paths, absence of cookies, and basic request behavior. Known search engine crawlers are detected separately to avoid SEO issues.

Example: Scoring a Suspicious Request

const { analyzeRequest } = require('request-risk-score');

const result = analyzeRequest({
  ip: '10.0.0.5',
  headers: { 'user-agent': 'curl/7.68.0' },
  url: '/admin/login'
});

console.log(result);

The output clearly explains why the request is considered risky:

{
  "score": 75,
  "bucket": "likely_automated",
  "signals": [
    "tool_user_agent",
    "sensitive_path",
    "no_cookies"
  ]
}

How You Can Use the Score

Rather than blocking traffic automatically, developers can use the risk score in different ways. Low-risk requests can be allowed normally, medium-risk requests can be logged or rate-limited, and high-risk requests can be challenged or blocked. This flexibility makes the approach safer and more adaptable.

Who Should Use This Package

This approach works well for small and medium Node.js applications, APIs without a CDN or WAF, and teams that want explainable security decisions. It is especially useful when you want visibility into suspicious traffic instead of aggressive blocking.

Get Started

You can install the package directly from npm:

npm install request-risk-score

Package link: https://www.npmjs.com/package/request-risk-score

Conclusion

Risk-based request analysis offers a practical and ethical alternative to traditional bot detection. By focusing on transparency and probability, request-risk-score helps developers reduce noise, protect sensitive routes, and maintain user trust without overengineering their systems.