Install Request Variation Controller

The Request Variation Controller integration is, in fact, two integrations that work together to protect your online assets.

In the response phase, the Hash Generator creates a signed cookie to track the different arguments the user (or the origin) is using across the requests. This cookie will be used for the second integration, the Hash Validator, which checks the number of variations made and blocks access to the origin whenever the user exceeded the maximum number permitted.

Getting the integration

Request Variation Controller is a serverless integration available at Azion Marketplace.

Remember, this integration is divided into two. To run it, you have to install the hash generator and the hash validator.

With the help of this integration, a signed cookie can be created or updated, containing details about how many different requests were made in succession to an application.

1. Access Azion Console > Marketplace.
2. On the Marketplace homepage, select the search box and type “variation” or browse through the cards to find the two Request Variation Controller integrations.
3. Once you’ve found the Request Variation Controller - Hash Generator and Request Variation Controller - Hash Validator cards, select one to go to the integration’s page.
4. Click the Install button.

You’ll follow the same steps to install the second integration.

In both cases, after clicking on the Install button, you’ll see a message indicating that your integration was successfully installed.

Configuring the integration

Once you’ve gotten your integration on Marketplace, it’ll be available at your functions list. To use the integration, you’ll have to create a new application.

Setting up an application

Proceed as follows:

1. On the upper-left corner, select Products menu > Application on the BUILD section.
2. On the listing page of your applications, select the one you’ve created to use with the Request Variation Controller integration.
3. On the Main Settings tab, locate the Functions switch and turn it on to enable Functions on your application.
4. Then, turn the Application Accelerator switch on to enable the Forward Cookies functionality for your application.
   • This will be addressed at the Rules Engine section.
5. Click the Save button.

You’ll receive a success message indicating that your application has been updated.

Instantiating the integration

To enable this function, while still on the Application page:

1. Select the Functions Instances tab on the top list.
2. Click the + Function Instance button.
3. Choose an easy to remember name for your function.
4. On the dropdown function menu, select the Variation Request function.
   • This action will load the Arguments tab.
   • For this integration, you must complete the configuration twice: one for the response phase and another one for the request phase.

For the response phase, the *Arguments are:

Where:

• cookie_name: defines the name of the cookie. The default value is “azn”.
• cookie_secret: defines the key used to encrypt the signed cookie. Due to the encryption algorithm used here, the AES-128, this key must have exactly 16 chars.
• cookie_max_age: define the time for the expiration of the cookie. If you don’t define any time (passing a null value or none value), the cookie will be a session cookie. The default value is 45.
• args_list: defines the nginx list of variables that will be analyzed on the user’s request. Whenever this changes, the count of changes will be increased. These parameters will be used to block or allow the access.

For the request phase, the Args are:

Where:

• cookie_name: defines the name of the cookie. It must be the same as the one defined at the response phase.
• cookie_secret: defines the secret key for the cookie. It must be the same as the one defined at the response phase.
• max_variation: defines the maximum number of any kind of variation in the parameters.
• max_unique_variation: defines the maximum number of unique variations in the parameters.

This function decrypts the signed cookie and checks to see if any cookie variants have been reached. If they have, a new request header with the name [COOKIE_ NAME]-[VIOLATION TYPE]-[TRUE] will be appended to the request.

Possible violations can assume 3 values

• All Variations: regardless of whether there are repeated values, it counts the number of times the cookie’s value was altered. For instance, if the cookie value changed from “nothing” to “A” in the first request, “A” to “B” in the second, “C” in the third, “B” to “C” in the fourth, “B” to “A” in the fifth, and finally “A” in the sixth request, the total number of variations would be 5. If the cookie has the default name, the violation header that is added to the request when this violation occurs is http_cookie_name_any_variation_violation.

• Unique variations: counts the number of distinct values that have been assigned to the cookie since its creation. Given that the cookie only had “A,” “B,” and “C” as distinct values, the unique variation for the same example as above would be 3. Assuming the cookie has the default name, when this violation occurs, a violation header called http_cookie_name_unique_variation_violation would be added to the request.

• Signature Violation: when the function is unable to decrypt the signed cookie (for example, because it was signed with a different key or because the cookie was altered on the client side), this violation will be brought about. Assuming the cookie has the default name, when this violation is triggered, the request will have the violation header http_cookie_name_signature_violation added to it.

Configuring a rule on Rules Engine

Still in the Application page, in the Rules Engine tab, you have to configure the rules you want (criteria and behavior) to apply to run your function.

You have to configure the response phase for the Rules Engine.

To do so, follow these steps:

1. Select the Rules Engine tab.
2. Click the + Rule Engine button.
3. Give an easy to remember name and, optionally, a description to your rule.
4. Select Response Phase.
5. Pass the criteria you need to in order to run your integration.
6. On the behavior field, select Run Function from the dropdown menu and then select the Variation Request - Hash Generator function, according to the name you gave it in the instantiation step.
7. Click the Save button.

Now, you have to configure the request phase for the Rules Engine.

To do so, follow these steps:

1. Select the Rules Engine tab.
2. Click the + Rule Engine button.
3. Give an easy to remember name and, optionally, a description to your rule.
4. Select Request Phase.
5. Pass the criteria you need to in order to run your integration.
6. On the behavior field, select Run Function from the dropdown menu and then select the Variation Request - Hash Validator function, according to the name you gave it in the instantiation step.
7. You’ll need a second behavior for the Request Variation Controller function, the Forward Cookies. To add this, click the + button and select the Forward Cookies option from the dropdown menu.
8. Click the Save button.

Done. You’ve successfully instantiated your two integrations and now you’re protected against attackers.