diff options
author | Bjørn Christian Seime <bjorncs@verizonmedia.com> | 2021-02-23 10:17:19 +0100 |
---|---|---|
committer | Bjørn Christian Seime <bjorncs@verizonmedia.com> | 2021-02-23 10:17:21 +0100 |
commit | ad518d3b7fd0e9836c4f899fdbb24cf4ad042c3a (patch) | |
tree | 4a62299e877f929db47a63dadd00963f1fffb21a /jdisc-security-filters/src/main | |
parent | f95c86bb12b8e26a2f822076ac1549cfc0184337 (diff) |
Add configurable response headers for blocked requests
Diffstat (limited to 'jdisc-security-filters/src/main')
2 files changed, 17 insertions, 6 deletions
diff --git a/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/rule/RuleBasedRequestFilter.java b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/rule/RuleBasedRequestFilter.java index 71f1965c764..7bdc386e4b4 100644 --- a/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/rule/RuleBasedRequestFilter.java +++ b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/rule/RuleBasedRequestFilter.java @@ -3,6 +3,7 @@ package com.yahoo.jdisc.http.filter.security.rule; import com.google.inject.Inject; import com.yahoo.jdisc.Metric; +import com.yahoo.jdisc.Response; import com.yahoo.jdisc.http.filter.DiscFilterRequest; import com.yahoo.jdisc.http.filter.security.base.JsonSecurityRequestFilterBase; import com.yahoo.jdisc.http.filter.security.rule.RuleBasedFilterConfig.Rule.Action; @@ -56,7 +57,11 @@ public class RuleBasedRequestFilter extends JsonSecurityRequestFilterBase { private static ErrorResponse createDefaultResponse(RuleBasedFilterConfig.DefaultRule defaultRule) { switch (defaultRule.action()) { case ALLOW: return null; - case BLOCK: return new ErrorResponse(defaultRule.blockResponseCode(), defaultRule.blockResponseMessage()); + case BLOCK: { + Response response = new Response(defaultRule.blockResponseCode()); + defaultRule.blockResponseHeaders().forEach(h -> response.headers().add(h.name(), h.value())); + return new ErrorResponse(response, defaultRule.blockResponseMessage()); + } default: throw new IllegalArgumentException(defaultRule.action().name()); } } @@ -100,9 +105,13 @@ public class RuleBasedRequestFilter extends JsonSecurityRequestFilterBase { .map(m -> m.name().toUpperCase()) .collect(Collectors.toSet()); this.pathGlobExpressions = Set.copyOf(config.pathExpressions()); - this.response = config.action() == Action.Enum.BLOCK - ? new ErrorResponse(config.blockResponseCode(), config.blockResponseMessage()) - : null; + this.response = config.action() == Action.Enum.BLOCK ? createResponse(config) : null; + } + + private static ErrorResponse createResponse(RuleBasedFilterConfig.Rule config) { + Response response = new Response(config.blockResponseCode()); + config.blockResponseHeaders().forEach(h -> response.headers().add(h.name(), h.value())); + return new ErrorResponse(response, config.blockResponseMessage()); } boolean matches(String method, URI uri) { diff --git a/jdisc-security-filters/src/main/resources/configdefinitions/jdisc.http.filter.security.rule.rule-based-filter.def b/jdisc-security-filters/src/main/resources/configdefinitions/jdisc.http.filter.security.rule.rule-based-filter.def index 374c3ca69c6..6abf3d43a7d 100644 --- a/jdisc-security-filters/src/main/resources/configdefinitions/jdisc.http.filter.security.rule.rule-based-filter.def +++ b/jdisc-security-filters/src/main/resources/configdefinitions/jdisc.http.filter.security.rule.rule-based-filter.def @@ -5,6 +5,8 @@ dryrun bool default=false defaultRule.action enum { ALLOW, BLOCK } defaultRule.blockResponseCode int default=403 defaultRule.blockResponseMessage string default="" +defaultRule.blockResponseHeaders[].name string +defaultRule.blockResponseHeaders[].value string rule[].name string rule[].action enum { ALLOW, BLOCK } rule[].hostNames[] string @@ -12,5 +14,5 @@ rule[].methods[] enum { GET, POST, PUT, PATCH, DELETE } rule[].pathExpressions[] string rule[].blockResponseCode int default=403 rule[].blockResponseMessage string default="" - - +rule[].blockResponseHeaders[].name string +rule[].blockResponseHeaders[].value string |