Configuration
All server SDKs share the same config shape (from @idebug/core).
interface IDebugConfig {
enabled: boolean; // default false
performance: boolean; // default true
appName: string | null;
basePath: string; // default '/__idebug'
maxSessions: number; // default 200
maxEventsPerSession: number; // default 500
maxTotalEvents: number; // default 10_000
redactKeys: string[]; // merged with built-in secret keys
db?: boolean | DbMonitorConfig; // default on when enabled — see @idebug/db
// Security (defaults maximize local-dev safety)
accessToken: string | null; // default null — set a secret when possible
hostCheck: boolean; // default true — Host must be localhost/loopback
allowedHosts: string[]; // extra Host values (e.g. myapp.local)
localRemoteOnly: boolean; // default true — peer must be loopback
}See Security posture for DNS rebinding, bind guards, and tokens.
Express
import IDebug from '@idebug/node';
IDebug.configure({
enabled: process.env.NODE_ENV !== 'production',
appName: 'billing-api',
performance: true,
db: true, // wrap clients with instrumentPrisma / instrumentDrizzle / …
basePath: '/__idebug',
maxSessions: 100,
redactKeys: ['ssn', 'taxId'],
accessToken: process.env.IDEBUG_TOKEN ?? null,
// hostCheck: true,
// localRemoteOnly: true,
});NestJS
IDebugModule.forRoot({
enabled: process.env.NODE_ENV !== 'production',
appName: 'billing-api',
performance: true,
db: true,
accessToken: process.env.IDEBUG_TOKEN ?? null,
});
// `register` is an alias of `forRoot`React
import { start } from '@idebug/react';
start({
enabled: true,
overlay: true,
maxEvents: 1000,
captureFetch: true,
captureXhr: true,
captureErrors: true,
captureNavigation: true,
redactKeys: ['sessionToken'],
});Safety defaults
| Setting | Default | Notes |
|---|---|---|
enabled | false | Middleware no-ops; wrappers still call original functions |
hostCheck | true | Blocks non-localhost Host (DNS rebinding) |
localRemoteOnly | true | Blocks non-loopback TCP peers |
accessToken | null | Optional; send Bearer / X-IDebug-Token / ?idebug_token= |
performance | true | Adds timings when enabled |
db | on when enabled | Query monitor; pass false to disable. See @idebug/db. |
| Redaction | on | authorization, password, token, … → *** |
| Production | — | Prefer enabled: process.env.NODE_ENV !== 'production' + bind 127.0.0.1 |
Ring buffer
When caps are exceeded, oldest sessions/events are evicted deterministically. Tune maxSessions, maxEventsPerSession, and maxTotalEvents for chatty apps.