Method and Route Validator

This function can be used to protect an application by blocking requests based on the URI and method used.

View as Markdown

Preview

The Method and Route Validator integration can be used to protect your application by blocking requests based on the URI and method used. It works by validating the arguments received by the function and checking if the request matches the patterns defined in any of the values.

With this integration, you can define a list of routes and which method each route expects. Each time the function is executed, it’ll perform the following steps:

  1. Validate the arguments passed to the function.
  2. Check if the request matches the patterns defined for the routes.
  • If there is a match, the function will perform a user-defined blocking action.
  • If there is no match, the function can be configured to continue the request or block it.
  1. If the arguments are invalid, it’ll write a log message and continue the request.

Getting the integration

To install this integration:

  1. Access Azion Console > Marketplace.
  2. On the Marketplace homepage, select the Method and Route Validator card.
  3. On the integration page, click the Install button.

You’ll see a message indicating that your integration was successfully installed.

You can search any integration by browsing through the cards, using the filters, or typing a keyword in the search bar.

Configuring the integration

Once you’ve installed the Method and Route Validator integration, you’ll need to complete the steps explained below to configure it.

Setting up a firewall

Follow the steps:

  1. On the upper-left corner, open the Products menu and select Firewall in the Secure section.
  2. Click the + Firewall button.
  3. Give an easy-to-remember name to your firewall.
  4. Enable the Functions switch in the Modules section.
  • This action gives access to functions on your firewall.
  1. Click the Save button.

Done. Now you’ve instantiated the firewall for your function and have access to functions on your firewall.

Setting up the Firewall function

While still on the Firewall page:

  1. Select the Functions Instances tab.
  2. Click the + Function Instance button.
  3. Give an easy-to-remember name to your instance.
  4. On the dropdown menu, select the Method and Route Validator function.
    • This action will load the Arguments tab.
  5. In the Arguments tab, you’ll pass the arguments for your function as in the following example:
{
"restricted_mode": false,
"action": "deny",
"routes": [
{
"match_type": "equals",
"path": "/my/route/",
"methods": ["GET", "POST"]
},
{
"match_type": "contains",
"path": "/something/",
"methods": ["POST"]
},
{
"match_type": "regex",
"path": "^.test.*",
"methods": ["GET", "POST", "PATCH", "DELETE"]
}
]
}

Where:

PropertyTypeRequiredDescription
restricted_modeBooleanNoIndicates if the function should operate in restricted mode. Default value: false.
actionStringYesDefines which action to take when the function identifies the request as invalid.
routesArrayYesContains all the URIs that the protected application expects to handle.
routes.match_typeStringYesString specifying the type of match to be performed on the path.
routes.pathStringYesDefines the argument to be used to validate the request URI.
routes.methodsArrayYesArray of strings specifying which methods can be used when making a request to the given path.
redirect_toStringOnly when action is redirectURL to which the request should be redirected when the redirect action is triggered. Can be a complete request URL or a relative path.
custom_response_bodyStringOnly when action is custom_responseCustom response body to be sent when the custom_response action is triggered.
custom_response_statusNumberNoStatus code of the response to be sent when the custom_response action is triggered. Default value: 400.
custom_response_content_typeStringNoContent type of the response to be sent when the custom_response action is triggered. Default value: plain/text.

The possible values for the action argument are:

ActionDescription
denyCloses the request with an HTTP 403 Forbidden response.
dropCloses the request without sending any response to the client.
redirectRedirects the request to another location.
custom_responseCloses the request with a static response to it.

The possible values for the match_type argument are:

Match TypeDescription
equalsThe path must be equal to the one defined in the path argument.
containsThe path must contain the one defined in the path argument.
regexThe path must match the regular expression defined in the path argument.

The routes.methods argument expects values in uppercase. Example: ["GET", "POST"].

  1. Click the Save button.

Setting up the Rules Engine

To finish, you have to set up a rule in Rules Engine to configure the criteria and the behavior to run the function.

Still in the Firewall page:

  1. Select the Rules Engine tab.
  2. Click the + Rule Engine button.
  3. Give a name to the rule.
  4. Select a criteria to run and catch the domains that you want to run the integration on.
  • Example: if Host matches yourdomain.com.
  1. Below, select a behavior to the criteria. In this case, it’ll be Run Function.
    • Select the adequate function according to the name you gave it during the instantiation step.
  2. Click the Save button.

On the Console, you must now configure your domain so your firewall protects it.

  1. On the Products menu, select Workloads.
  2. Click on the domain you want to protect with your Method and Route Validator function.
  3. In the Settings section, click on the Firewall selector and choose the firewall you created.
  4. Click the Save button.

Done. Now Method and Route Validator is running and protecting your domains.