Angular SSR on Railway or Render with WebDecoy

A Angular SSR app for Railway or Render with WebDecoy bot detection on every route. Deploy it as a starting point, or copy what src/server.ts does into your own app.

What you get

• An Angular 22 app rendered on the server by the Express server the Angular CLI generates, with @webdecoy/express in front of every page render in monitor mode: automated requests are recorded in your WebDecoy dashboard and every request is still served. Static assets are served first and never analyzed.
• A hidden honeytoken link injected into the rendered HTML, including streamed renders. Scrapers that follow it identify themselves; people never see it.
• The real visitor IP on either platform, chosen by the RENDER variable Render sets:
  • Railway sends X-Forwarded-For: <client>, <edge> and drops anything the client sent, so the server trusts two hops. With the common trust proxy: 1, every visitor would look like Railway's edge.
  • Render appends to whatever the client sent (<anything>, <client>, <cloudflare>, <render>), so the leftmost value is the client's choice. The server trusts three hops for req.ip, and WebDecoy reads CF-Connecting-IP, which Cloudflare sets and refuses to accept from a client.
• Angular's host check (SSRF protection) set up for Railway: *.up.railway.app and *.onrender.com are allowed. Using a custom domain? Add it to the NG_ALLOWED_HOSTS variable, comma-separated, or Angular answers 400.
• A /health route for the platform healthcheck, never analyzed.

Deploy

1. Create a free account at app.webdecoy.com and add your site.
2. Create an API key under Settings > API Keys.
3. Click Deploy on Railway or Deploy to Render and paste the key into WEBDECOY_API_KEY when asked. The key is a secret: keep it in the platform's variables, never in a file you commit.

Without a key the app still runs, with local rules only, and nothing reports.

Prove it reports

Request any page with the reserved test user agent:

curl -A "WebDecoy-Test/1.0" https://YOUR-APP-DOMAIN/

A detection labeled Test appears on the Detections page within a few seconds. Test detections are excluded from stats and billing.

Enforce

When you have seen what it would block, set mode: 'enforce' in src/server.ts. Blocked requests then get a 403; pass onBlocked to answer them your own way. See the docs.

Run locally

npm install
npm run build
WEBDECOY_API_KEY=... npm start   # http://localhost:4000

npm run dev runs ng serve for day-to-day work.