Solved: Deny requests other than defined resources and req... - Page 2

guy_hagemans · 06-01-2015 07:56 AM

Hi All,

I'm wondering if there is any solution to simply denying any request that doesnt adhere to the defined combination of the defined Resources and Request Verb.

Solutions I had in mind;

Create a Routerule that triggers when one of the combinations are not found (please note that this will be difficult because the target endpoint is of type OData, so the proxy.pathsuffix becomes very long because the query is included. )
Implement a threat protection policy that triggers when the pathsuffix doesnt start with the known resources.
Only fill the endpoint url in case one of the resources were found in a Condition.

But I hope there is a better solution. Thanks in advance!

-Guy

ceber

I don't think this will be difficult. Set wildcards to handle your OData bits, and use a catchall flow at the end of the proxy endpoint.. See below.

<ProxyEndpoint name="default">
    <Description/>
    <PreFlow name="PreFlow">
        <Request/>
        <Response/>
    </PreFlow>
    <Flows>
        <Flow name="Get item">
            <Description/>
            <Request>
                <Step>
                    <FaultRules/>
                    <Name>ExtractId</Name>
                </Step>
            </Request>
            <Response/>
            <Condition>(proxy.pathsuffix MatchesPath "/{id}") and (request.verb = "GET")</Condition>
        </Flow>
        <Flow name="Get sub-item">
            <Description/>
            <Request>
                <Step>
                    <FaultRules/>
                    <Name>ExtractId</Name>
                </Step>
            </Request>
            <Response>
                <Step>
                    <FaultRules/>
                    <Name>jsonPath</Name>
                </Step>
            </Response>
            <Condition>(proxy.pathsuffix MatchesPath "/{id}/**") and (request.verb = "GET")</Condition>
        </Flow>
        <Flow name="unhandled request">
            <Description/>
            <Request>
                <Step>
                    <FaultRules/>
                    <Name>404</Name>
                </Step>
            </Request>
            <Response/>
        </Flow>
    </Flows>
    <PostFlow name="PostFlow">
        <Request/>
        <Response/>
    </PostFlow>

View solution in original post

Deny requests other than defined resources and request verbs