BastionLLM

Blog

Guide10 min read

How to Configure BastionLLM for SSE and NDJSON Streaming Endpoints

Streaming LLM endpoints need parser-aware security testing. This guide shows the exact BastionLLM configuration for SSE and NDJSON formats, including payload schema and response field path setup.

Table of Contents

Most LLM security testing tools assume your endpoint returns a single JSON blob. If your app streams responses via Server-Sent Events or newline-delimited JSON, you already know that assumption breaks quickly. BastionLLM handles both formats natively.

This guide walks through the exact configuration steps for each.

Why Streaming Endpoints Need Dedicated Security Testing

Streaming responses change how you parse output. Instead of reading onechoices[0].message.contentfield, you reassemble a response from a sequence of chunks.

That difference matters for security testing because attack verdicts depend on reading the full model output accurately.

If your scanner cannot parse SSE or NDJSON correctly, it either misses injected content in mid-stream chunks or produces false passes because it never saw the complete response. Neither outcome is acceptable when testing for prompt injection or jailbreak behavior.

BastionLLM handles streaming response reassembly before applying verdict logic, so pass/fail results reflect the actual full output your users see.

Supported Streaming Formats

BastionLLM supports two streaming formats:

  • SSE (Server-Sent Events) - the format used by OpenAI streaming APIs and most OpenAI-compatible endpoints. Each chunk arrives as adata:prefixed line.
  • NDJSON (Newline-Delimited JSON) - used by Anthropic-style streaming APIs and several open-source model servers. Each line is a self-contained JSON object.

Both formats are supported in the Pro tier alongside standard JSON.

Configuring an SSE Endpoint

Endpoint URL and Auth

Start by entering your endpoint URL. For most OpenAI-compatible deployments this looks like:

https://your-api.example.com/v1/chat/completions

Under Authentication, select the method your endpoint uses. BastionLLM supports API key auth (Bearer token in theAuthorizationheader) and challenge-token auth for custom gateways.

Enter your key and BastionLLM verifies connectivity before running attacks. Set theResponse Formatfield toSSE.

Payload Schema

BastionLLM injects attack payloads by substituting into a field you define in the payload schema. For a standard chat completions endpoint:

{
  "model": "gpt-4o",
  "stream": true,
  "messages": [
    {
      "role": "user",
      "content": "{{ATTACK_PAYLOAD}}"
    }
  ]
}

The{{ATTACK_PAYLOAD}}placeholder marks where each attack string is injected.

Keep"stream": trueso your endpoint emits SSE output. If your gateway adds custom fields (for examplesession_id), include them in the schema as well.

Response Field Path Parsing

For SSE, eachdata:chunk usually contains a JSON object. Configure theResponse Field Pathfor the per-chunk text delta. For OpenAI-compatible streams:

choices[0].delta.content

BastionLLM reads that field from each chunk, concatenates values across the full stream, then applies verdict logic to the assembled output. Chunks with[DONE]signals or empty deltas are skipped automatically.

If your endpoint uses another path, set that instead. For example:output.text.

Configuring an NDJSON Endpoint

Payload Schema

NDJSON setup follows the same pattern. SetResponse FormattoNDJSONand define your payload schema. For an Anthropic-style endpoint:

{
  "model": "claude-3-5-sonnet-20241022",
  "max_tokens": 1024,
  "stream": true,
  "messages": [
    {
      "role": "user",
      "content": "{{ATTACK_PAYLOAD}}"
    }
  ]
}

Response Parsing for NDJSON

Each NDJSON line is a complete JSON object. Anthropic-style streams use event types likecontent_block_deltato carry text.

Set yourResponse Field Pathto:

delta.text

BastionLLM filters lines where the relevant event contains text, extracts this field, and concatenates all matching values before scoring.

If your NDJSON structure differs, adjust the field path. Lines missing the field are ignored without failing parsing.

Running a Scan Against a Streaming Endpoint

Once endpoint URL, auth, payload schema, and response field path are configured, run a connectivity check first. BastionLLM sends a benign probe and confirms streaming parsing works as expected.

A green status means the parser is reading your chunks correctly. Then trigger a scan. BastionLLM runs attack payloads from selected attack groups, reassembles each stream, and returns pass/fail verdicts with raw concatenated output for every attack.

On Pro, you can schedule weekly scans so streaming endpoints are retested automatically as model behavior and system prompts change over time.

What BastionLLM Tests on Streaming Endpoints

Attack coverage is identical to non-streaming endpoints. Streaming affects parsing, not the attack categories.

Scans cover:

  • Prompt injection (OWASP LLM01), including direct and indirect vectors.
  • Jailbreaks, including DAN attacks and role-play manipulation.
  • System prompt leak detection.
  • Safety bypass attempts across attack groups:promptinject,lmrc,goodside,latentinjection,prefix, andwebinjection.

Results export in PDF or JSON and are stored for up to 1 year of history on Pro.

If you are building a streaming chat feature, copilot, or agent and want to validate it against these attack classes, start testing at bastionllm.com.

FAQs

Does BastionLLM support endpoints that switch between streaming and non-streaming responses?

No. You configure one response format per saved endpoint. If your endpoint supports both modes, create separate endpoint configurations for each and scan them independently.

What happens if my SSE stream includes [DONE] or other sentinel values?

BastionLLM skips lines containing [DONE] and other non-data signals automatically. Only lines with parseable JSON matching your field path contribute to the assembled response.

Can I test a self-hosted model server that uses NDJSON but a non-standard field structure?

Yes. The response field path is fully configurable. As long as each NDJSON line is valid JSON and your target content lives at a consistent field path, BastionLLM can parse it.

Is streaming endpoint support available on the free tier?

The free tier supports manual scans with up to 25 attacks and 1 saved endpoint, including SSE and NDJSON response modes. Pro at EUR 49/month or EUR 449/year, tax included, adds weekly automated scans, 3 endpoints, and 12-month history.

How does BastionLLM handle chunks where the content field is null or missing?

Lines where the target field is absent or null are skipped during reassembly. Only chunks that return a non-empty string value at the configured field path contribute to the final response text.

Does configuring a streaming endpoint affect which attack groups run?

No. The attack groups available to your plan run regardless of response format. Streaming configuration only affects how BastionLLM reads and reassembles the model output.

Can I export scan results from a streaming endpoint test in the same formats as standard scans?

Yes. PDF and JSON export work the same way for streaming and non-streaming endpoints. The exported report includes pass/fail verdicts and the raw reassembled response for each attack.

OWASP LLM Top 10: Complete Security Guide

Get the full reference for prompt injection attacks, LLM jailbreaks, system prompt leaks, and OWASP-aligned testing workflows in one pillar guide.

Read the OWASP LLM Top 10 guide