Functions for Firewall

By using Functions in JavaScript on your Firewall you can boost your protection, have more dynamism, and apply the logic that your business requires.

View as Markdown

Functions are functions that run on the Azion Web Platform with low latency, bringing the operational power closer to the end user.

Firewall supports functions. Through them you can write your own security source code in JavaScript and deploy it to run at the edge of the network.

With functions on Firewall, you can:

  • Boost your protection.
  • Have more dynamism.
  • Apply the logic that your business requires.
  • Use APIs that provide request and response headers manipulation.

Implementation

ScopeGuide
Function for FirewallHow to create and configure an function on your Firewall
ExamplesExamples
Code samplesGitHub repository

How Functions work with Firewall

The functions in JavaScript on the Firewall run in the request phase.

Process

  • The rules configured on the Firewall Rules Engine for the function to run are triggered.
  • Azion Runtime processes the function, returning an outcome.
  • Firewall Rules Engine resumes the processing, based on the outcome, from the point the behavior was triggered.

All functions used on Firewall must have a finishing outcome in it, such as: event.continue(), event.deny(), and event.drop().

Add Request Header

You can add new headers to the request that is sent to the origin.

addEventListener("firewall", (event) => {
event.addRequestHeader("X-Custom-Header-1", "1");
event.addRequestHeader("X-Custom-Header-2", "2");
event.continue();
});

Add Response Header

You can add new headers to the response that is sent to users.

addEventListener("firewall", (event) => {
event.addResponseHeader("X-Custom-Header-3", "3");
event.addResponseHeader("X-Custom-Header-4", "4");
event.continue();
});

Deny (403 Forbidden)

Through the event event.deny(), you can finish a request returning HTTP 403 Forbidden.

addEventListener("firewall", (event) => {
event.deny();
});

Drop (Close Without Response)

Through the event event.drop() you are able to finish the request without returning an answer to the client.

addEventListener("firewall", (event) => {
event.drop();
});

Respond with

Through the event event.respondWith() you can intercept requests, return custom responses, and modify the response headers or content.

event.respondWith(new Response('{"my_custom_response": true}', {
status: 599,
headers: { "content-type": "application/json" }
}));

Metadata

The Functions on Firewall have a set of metadata available for manipulation.

By using this metadata you’re able to filter and manage the access to your application and apply the specific logic in different scenarios, such as:

The GeoIP information

You can deny access to your application when the request comes from certain places.

Find out more about the GeoIP metadata list.

Remote

You’re able to check the IP address and the TCP port used.

Find out more about the Remote metadata list.

Server

You’re able to check the protocol being used in the request.

Find out more about the Server metadata list.

TLS

The TLS-related metadata is available when the request is made over a secure TLS connection.

Find out more about the TLS metadata list.

Azion Samples repository

Check the Azion Samples repository on GitHub and analyze the code samples that can help you develop your own functions.

Best practices

Conditionals

When working with conditionals and event.method, use if else. In case the implementation is similar to:

if (someCondition){
event.drop()
}
event.continue()

It may end up with unexpected behaviors.

It’s highly recommended to use as follows:

if (someCondition){
event.drop()
}else{
event.continue()
}

Sync x async

Since the eventHandler is sync, it’s necessary to write an async function when await is implemented.

It’s recommended to use event.waitUntil, otherwise the promise may end up in unexpected exceptions.

async function firewallHandler(event) {
// any async operation here like fetch, timeout etc.
}
addEventListener("firewall", (event) => event.waitUntil(firewallHandler(event)));
}

Limits

Increase limits
You can request to increase the limits based on your plan. Contact the technical support team to request it.

These are the default limits:

ScopeLimit
Arguments100 KB
Memory per Isolate512 MB
Code Limit (UI)6 MB
Code Limit (API)50 MB
Environment variable size32 KB
Sub-Requests50 Sub-Req
Max CPU Execution Time2s