Node.js + OpenAI: Validate Prompts Before Sending to GPT-4o

Your Node.js app can stop flagged text before starting an OpenAI call. Build the context on the server, screen it, and forward only that checked text. Keep data access and tool permissions in server code.

Why does your Node.js OpenAI app need input validation?

Your system instruction defines the task, and user or external text may try to change it. Model roles identify those sources. A successful prompt injection is an observed departure from the authorized task, such as exposing a private record or executing an unapproved tool action.

SafePrompt returns a verdict on the submitted context before your model adapter runs. The server allows a valid true verdict to proceed and stops inference on false or an unavailable check.

How do I get a SafePrompt API key?

Sign up at safeprompt.dev, confirm your email and open the dashboard to get your key. The free plan includes 10,000 free validations per month with no credit card. Add your key to your environment alongside your existing OpenAI key:

#.env
SAFEPROMPT_API_KEY=sp_live_your_key_here
OPENAI_API_KEY=sk-your-openai-key-here

How do I validate input before calling OpenAI?

The protectInput function below takes the complete checked string, a trusted end-user IP and your model adapter. It sends strict mode, checks HTTP status and requires safe to be a boolean. The context-builder tab shows how to include authorized history and retrieval without accepting browser-supplied roles.

async function protectInput(prompt, endUserIp, runModel) {
  if (typeof prompt !== 'string' || !prompt.trim() || !endUserIp) {
    return { status: 400, error: 'Invalid request' }
  }
  let verdict
  try {
    const res = await fetch('https://api.safeprompt.dev/api/v1/validate', {
      method: 'POST',
      signal: AbortSignal.timeout(5000),
      headers: {
        'X-API-Key': process.env.SAFEPROMPT_API_KEY,
        'X-User-IP': endUserIp,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({ prompt, sensitivity: 'strict' })
    })
    if (!res.ok) throw new Error('Validation unavailable')
    verdict = await res.json()
    if (typeof verdict?.safe !== 'boolean') throw new Error('Invalid verdict')
  } catch {
    return { status: 503, error: 'Validation unavailable' }
  }
  if (!verdict.safe) return { status: 403, error: 'Input rejected' }
  return { status: 200, result: await runModel(prompt) }
}

How do I apply validation to my Express model routes?

Mount the gate only on model routes that accept the documented { message: string } body. Missing or extra fields return 400. The middleware calls next only after a valid true verdict, and the handler forwards req.screenedContext without appending more text. Use the Express proxy guide to configure trusted ingress before relying on a forwarded client address.

// Mount after express.json(). resolveCaller uses authentication and trusted ingress.
function createInputMiddleware({ resolveCaller, buildContext }) {
  return async function inputGate(req, res, next) {
    try {
      const caller = await resolveCaller(req)
      if (!caller?.userId || !caller?.ip) {
        return res.status(401).json({ error: 'Unauthorized' })
      }
      const body = req.body
      if (!body || Array.isArray(body) || Object.keys(body).length !== 1 ||
          typeof body.message !== 'string' || !body.message.trim()) {
        return res.status(400).json({ error: 'Expected only message text' })
      }
      const context = await buildContext({ userId: caller.userId, message: body.message })
      const result = await protectInput(context, caller.ip, async checked => checked)
      if (result.status !== 200) {
        return res.status(result.status).json({ error: result.error })
      }
      req.screenedContext = result.result
      return next()
    } catch {
      return res.status(503).json({ error: 'Processing unavailable' })
    }
  }
}

How do I validate streaming and multi-turn chats?

The streaming route uses the same gate before starting the model or sending stream headers. A false verdict returns 403; validation errors return 503. A later rejection cannot retract tokens already delivered.

Your server should load conversation history for the authenticated user and include it in the screened context. SafePrompt session tokens can link validation checks; they do not establish gradual-escalation detection. Replay the complete history in an application test and assert the forbidden outcome.

// runStream receives only the checked context and yields text chunks.
function mountStreamingChat(router, gate, runStream) {
  router.post('/chat/stream', gate, async (req, res, next) => {
    try {
      const stream = await runStream(req.screenedContext)
      res.setHeader('Content-Type', 'text/event-stream')
      res.setHeader('Cache-Control', 'no-cache')
      for await (const text of stream) {
        res.write('data: ' + JSON.stringify({ text }) + '\n\n')
      }
      res.write('data: [DONE]\n\n')
      return res.end()
    } catch (error) { return next(error) }
  })
}
// Stop or close a failed stream according to your Express error handler.

What does the validation response look like?

The abridged JSON below illustrates the response shape. Its confidence values are examples, not new detector observations. Require a boolean safe field before allowing the model call.

// Attack detected
{
  "safe": false,
  "threats": ["jailbreak_instruction_override", "extraction_system_prompt"],
  "confidence": 0.97,
  "reasoning": "Input attempts to override system instructions and extract the system prompt."
}

// Safe input
{
  "safe": true,
  "threats": [],
  "confidence": 0.99,
  "reasoning": "No injection patterns detected."
}

safe is your gate. threats is an array of categories such as jailbreak_instruction_override, jailbreak_role_play, extraction_system_prompt, exfiltration_target, and reference_obfuscated; log it to see what is being thrown at you. confidence runs 0 to 1, and reasoning is a short human-readable explanation you can surface in logs.

What about prompt injection hidden in content your app retrieves?

Retrieved documents, fetched pages and tool results can contain attacker instructions even when the user message is ordinary. Include that text in the checked model context. The indirect injection guide explains this entry route.

The fix is the same call, pointed at a different input. Before you pass retrieved text, a fetched page, or a tool result into the model, send it to the same https://api.safeprompt.dev/api/v1/validate endpoint and block on safe: false. Validate every piece of untrusted text that reaches GPT-4o, not just the message in the chat box.

What SafePrompt covers

SafePrompt screens submitted instruction attacks before inference. Your application enforces the verdict and retains control of authentication, rate limits, record access and tool permissions.

Does validating prompts slow down OpenAI responses?

Your validation request adds a network round trip. Measure the delay with representative context lengths and pick a timeout from the application request budget. The examples stop inference when screening cannot complete.

• Fail open (allow the request) keeps you available during a SafePrompt outage, with no protection for that window. Any such bypass needs an explicit application policy.
• Fail closed (block the request) stops the model call during an outage. Right for anything handling sensitive data.

// protectInput returns503 for HTTP, timeout, JSON or schema failures.
const result = await protectInput(assembledContext, endUserIp, runModel)
// Translate result.status into the route response; never call runModel again here.

Quick start checklist

Frequently asked questions

Further reading

• Detect prompt injection in Node.js and Python the implementation guide for both stacks