Zen does not block attacks by default; set AIKIDO_BLOCK=true to actually stop them

TL;DR: If you installed Aikido Zen and attacks are showing up in your dashboard but nothing is actually blocked, that is the default: Zen detects and reports but does not block until you set AIKIDO_BLOCK=true in the environment.

Fix

1. If you installed Aikido Zen and attacks are showing up in your dashboard but nothing is actually blocked, that is the default: Zen detects and reports but does not block until you set. Expected: this specific failure stops.

2. must be the very first import, above everything else, or the instrumentation misses modules loaded earlier; (2) if you want per-user rate limiting or user blocking, call. Expected: this specific failure stops.

Details

AIKIDO_BLOCK=true in the environment. The docs recommend running with blocking enabled on staging for about a week before turning it on in production, so you can tune out false positives first. Two related setup points from the same docs: (1) import aikido_zen / require('@aikidosec/firewall') set_user({"id", "name"}) from your auth middleware as soon as the user is identified, otherwise Zen only sees IPs.

When to use

You hit exactly this: Zen does not block attacks by default; set AIKIDO_BLOCK=true to actually stop them in Zen.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Zen.

Documented gotcha from official Aikido Security docs: Official docs (Aikido firewall-python docs/fastapi.md, github.com/aikidosec/firewall-python): documents the gotcha that Zen runs in non-blocking mode by default. When it detects an attack it reports it to Aikido and lets the call continue executing, so attacks are logged but not stopped unless you opt in. The verified fix/answer: If you installed Aikido Zen and attacks are showing up in your dashboard but nothing is actually blocked, that is the default: Zen detects and reports but does not block until you set AIKIDO_BLOCK=true in the environment. The docs recommend running with blocking enabled on staging for about a week before turning it on in production, so you can tune out false positives first. Two related setup points from the same docs: (1) import aikido_zen / require('@aikidosec/firewall') must be the very first import, above everything else, or the instrumentation misses modules loaded earlier; (2) if you want per-user rate limiting or user blocking, call set_user({"id", "name"}) from your auth middleware as soon as the user is identified, otherwise Zen only sees IPs. Source: https://github.com/aikidosec/firewall-python/blob/HEAD/docs/fastapi.md