uri-blocker

Blocks requests whose URI matches a rule.

Category SecurityAdd it to Route, Service, Consumer, Consumer group, Global rule, Plugin configEngine plugin uri-blockerPriority 2900

What it does

uri-blocker refuses a request to the route when its path matches one of the Block rules. A refused request never reaches the backend and is answered 403, or the code you set under Rejected code. Every other request passes.

It suits a route that serves many paths, where a few of the backend's paths must stay out of reach. A Rejected message reaches the client as JSON under error_msg.

When to use it

• A route that passes a whole prefix of the orders API to the backend, where its /admin/ and /internal/ paths must stay out of reach.
• Paths callers should not learn exist, answered 404 as if nothing were there.
• Requests that carry a query parameter you never accept, secret= for example.
• A backend that would serve its .git folder if asked.

Not for judging the address a request arrives from — see ip-restriction (Allows or denies clients by IP address or CIDR range), judging the client software by its User-Agent header — see ua-restriction (Allows or denies clients by their User-Agent) or judging the page that sent the client, by its Referer header — see referer-restriction (Allows or denies requests by their Referer header).

Set it up

Refuse requests for administrative paths with a not-found answer

Fill Block rules as in the JSON below, turn on Case insensitive, set Rejected code to 404 and set Rejected message to This path is not served here..

uri-blocker · as the console saves it

{
  "block_rules": [
    "^/admin/",
    "^/internal/"
  ],
  "case_insensitive": true,
  "rejected_code": 404,
  "rejected_msg": "This path is not served here."
}

Things to know

• Block rules — With ^/admin/ and ^/internal/ as rules and 404 as the code, a request for /admin/users is answered 404 with your Rejected message, and a request for another path of the route passes.
• Block rules — The rules are joined into one expression and matched against the path and the query string together, so secret= refuses /orders?secret=1.
• Block rules — A rule that does not compile as an expression, ^/admin/( for example, is refused when you save.
• Case insensitive — On, /Admin/users is refused by the rule ^/admin/ as /admin/users is.
• Rejected code — Sent exactly as written: 499 closes the connection without an answer, and 200 makes a refusal look like a success.
• Rejected code — A code of four digits, 1000 for example, is refused when you save.
• AdviceStart a rule with ^ when it names the beginning of a path, and keep each rule to one path you mean to close.

Settings

The fields as the console shows them, section by section.

Block rulesblock_rulesarray of stringsRequired

at least 1 item; each 1 to 4096 characters

Case insensitivecase_insensitivebooleandefault false

Rejected coderejected_codeintegerdefault 403

200 to 999

Rejected messagerejected_msgstring

Left empty, the refusal carries the server's own error page and no JSON body of its own.

at least 1 character

Every plugin also has Enabled, Priority, Filter, Error response and Pre-function: see Plugin execution settings.