# Functions for Firewall

[Functions](/en/documentation/products/build/applications/functions/) are functions that run on the Azion Web Platform with low latency, bringing the operational power closer to the end user.

[Firewall](/en/documentation/products/secure/firewall/) supports functions. Through them you can write your own security source code in JavaScript and deploy it to run at the edge of the network.

With functions on Firewall, you can:

- Boost your protection.
- Have more dynamism.
- Apply the logic that your business requires.
- Use APIs that provide **request** and **response** headers manipulation.

---

## Implementation

| Scope | Guide |
| - | - | 
| Function for Firewall | [How to create and configure an function on your Firewall](/en/documentation/products/guides/edge-functions/firewall/) |
| Examples | [Examples](/en/documentation/devtools/javascript-examples/) |
| Code samples | [GitHub repository](https://github.com/aziontech/azion-samples/tree/dev/samples) |

---

## How Functions work with Firewall 

:::note
The functions in JavaScript on the Firewall run in the request phase.
:::

## Process

- The rules configured on the Firewall *Rules Engine* for the function to run are triggered.
- Azion Runtime processes the function, returning an outcome.
- Firewall Rules Engine resumes the processing, based on the outcome, from the point the behavior was triggered.

---

:::note
All functions used on Firewall must have a *finishing outcome* in it, such as: `event.continue()`, `event.deny()`, and `event.drop()`.
:::


## Add Request Header

You can add new headers to the request that is sent to the origin.

``` javascript
  addEventListener("firewall", (event) => {
      event.addRequestHeader("X-Custom-Header-1", "1");
      event.addRequestHeader("X-Custom-Header-2", "2");
      event.continue();
  });
```

---

## Add Response Header

You can add new headers to the response that is sent to users.

```js
  addEventListener("firewall", (event) => {
      event.addResponseHeader("X-Custom-Header-3", "3");
      event.addResponseHeader("X-Custom-Header-4", "4");
      event.continue();
  });
```

---

## Deny (403 Forbidden)

Through the event `event.deny()`, you can finish a request returning HTTP 403 Forbidden.

```js 
  addEventListener("firewall", (event) => {
      event.deny();
  });
```

---

## Drop (Close Without Response)

Through the event `event.drop()` you are able to finish the request without returning an answer to the client.

```js 
  addEventListener("firewall", (event) => {
      event.drop();
  });
```

---

## Respond with

Through the event `event.respondWith()` you can intercept requests, return custom responses, and modify the response headers or content.

```js
    event.respondWith(new Response('{"my_custom_response": true}', {
        status: 599,
        headers: { "content-type": "application/json" }
    }));
```

## Metadata

The Functions on Firewall have a set of metadata available for manipulation.

By using this metadata you're able to filter and manage the access to your application and apply the specific logic in different scenarios, such as:

### The GeoIP information

You can deny access to your application when the request comes from certain places.

Find out more about the [GeoIP metadata list](/en/documentation/products/applications/functions/runtime/api-reference/metadata/#geo-ip).

### Remote

You're able to check the IP address and the TCP port used.

Find out more about the [Remote metadata list](/en/documentation/products/applications/functions/runtime/api-reference/metadata/#remote).

### Server

You're able to check the protocol being used in the request.

Find out more about the [Server metadata list](/en/documentation/products/applications/functions/runtime/api-reference/metadata/#server).

### TLS

The TLS-related metadata is available when the request is made over a secure TLS connection.

Find out more about the [TLS metadata list](/en/documentation/products/applications/functions/runtime/api-reference/metadata/#tls).

---

## Azion Samples repository

Check [the Azion Samples repository](https://github.com/aziontech/azion-samples) on GitHub and analyze the code samples that can help you develop your own functions.

## Best practices 

### Conditionals

When working with conditionals and `event.method`, use `if else`. In case the implementation is similar to:

```javascript
  if (someCondition){
      event.drop()
  }
  event.continue()
```

It may end up with unexpected behaviors. 

It's highly recommended to use as follows:

```javascript
  if (someCondition){
      event.drop()
  }else{
      event.continue()
  }
```

---

### Sync x async

Since the `eventHandler` is sync, it's necessary to write an async function when `await` is implemented.

It's recommended to use `event.waitUntil`, otherwise the promise may end up in unexpected exceptions.

```javascript
async function firewallHandler(event) {
 // any async operation here like fetch, timeout etc.
}

addEventListener("firewall", (event) => event.waitUntil(firewallHandler(event)));

}

```

---

## Limits

:::tip
**Increase limits** <br></br>
You can request to increase the limits based on your plan. Contact the [technical support team](/en/documentation/services/support/) to request it.
:::

These are the **default limits**:

| Scope | Limit |
| ----- | ----- |
| Arguments | 100 KB |
| Memory per Isolate | 512 MB |
| Code Limit (UI) | 6 MB |
| Code Limit (API) | 50 MB |
| Environment variable size | 32 KB |
| Sub-Requests | 50 Sub-Req |
| Max CPU Execution Time | 2s |