How to deny routes using patterns in version 23.2.2?

[amorelIM]

Hi,

We use Ocelot to put some services behind a gateway. We are using version 22.0.1 and I tried to update Ocelot to version 23.2.2 but I have some problems using placeholders in routing.

In our services we have endpoints that we don't want to expose through the gateway. For example, we have routes following similar patterns.

1. GET /v1/Products
2. GET /v1/Products/{id}
3. POST /v1/Products/{id}/SomePublicAction
4. POST /v1/Products/{id}/SomeInternalAction
5. GET /v1/Products/{id}/SomeInternalData

I would like to expose routes 1, 2 and 3 in Ocelot, but hide routes 4 and 5. At the time we didn't find a way to deny routes using patterns. So we found a solution with patterns.

{
  "UpstreamHttpMethod": [ "Get" ],   
  "UpstreamPathTemplate": "/v2/Products",   
  "DownstreamPathTemplate": "/v1/Products",
  "DownstreamScheme": "https", 
},
{
  "UpstreamHttpMethod": [ "Post" ],   
  "UpstreamPathTemplate": "/v2/Products/{id}/SomeAction",   
  "DownstreamPathTemplate": "/v1/Products/{id}/SomePublicAction",   
  "DownstreamScheme": "https", 
},
{
  "UpstreamHttpMethod": [ "Get" ],
  "UpstreamPathTemplate": "/v2/Products/{id}",
  "DownstreamPathTemplate": "/v1/Products/{id}",
  "DownstreamScheme": "https", 
},
{
  "UpstreamHttpMethod": [ "Get", "Post" ], 
  "UpstreamPathTemplate": "/v2/Products/{id}/{all}",
  "DownstreamPathTemplate": "/unknown",
  "DownstreamScheme": "https",
}

With the last item in the configuration you can see that we redirect everything else to a route we know it doesn't exist (i.e. /unknown). This way, we only expose the endpoints we want and everything else isn't because the underlying service returns a status 404.

In version 23.2.2 there is the empty placeholder feature that was added, and I think it breaks the configuration we added. Now, the last two items in the configuration comes into conflict. Depending on the order in the list, either all routes under /Products/{id} are exposed or none of them.

Is there a better way to achieve what we want? In a real-life example, we can have more endpoints that we don't want to expose.

Thank you for your help.

[raman-m]

Hi Alexis!
Welcome to Ocelot world! 🐯

In version 23.2.2 there is the empty placeholder feature that was added, and I think it breaks the configuration we added.

We apologize, but this feature will be a permanent part of Ocelot. You need to adapt/redefine your routes.

Now, the last two items in the configuration comes into conflict. Depending on the order in the list, either all routes under /Products/{id} are exposed or none of them.

The solution involves using the Routing Priority feature to assign the highest priority to the last "/unknown" route. The remaining routes should be assigned a lower priority and can be consolidated into a single Catch All route.

The solution

{
  "UpstreamHttpMethod": [ "Get", "Post" ], 
  "UpstreamPathTemplate": "/v2/Products/{id}/{all}",
  "DownstreamPathTemplate": "/unknown",
  "DownstreamScheme": "https",
  "Priority": 1 // higher priority
},
{
  "UpstreamHttpMethod": [ "Get", "Post" ],
  "UpstreamPathTemplate": "/v2/Products/{catchAll}",
  "DownstreamPathTemplate": "/v1/Products/{catchAll}",
  "DownstreamScheme": "https", 
  "Priority": 0
}

But this solution should be tested first.

Hope it helps!

[amorelIM]

Thanks for your answer Raman!

It works partially. My only problem is that with this solution, the route GET /v1/Products/{id} is denied because it matches the pattern /v2/Products/{id}/{all} and the priority is higher.

Any idea what could I do?

Thank you.

[raman-m]

In your use case:

• Firstly, there are several static paths that need to be restricted or closed.
• Secondly, the open and closed paths bear a strong resemblance to each other.
• Thirdly, the Catch All route fails to distinguish closed paths, rendering a Catch All-based solution ineffective.
• Fourthly, the Ocelot Routing feature lacks the capability for static/dynamic path filtering (a potential new feature could be discussed).

Let's consider the next solution. There are two potential options that could work for your situation:

• Continue to manually define 'N' forbidden upstream paths that correspond to downstream ones.
• Create a custom Delegating Handler for path filtering, which I think would be the optimal solution.

1st Solution

It's presumed that the Priority feature can be utilized in advance to correctly assign values to the existing JSON:

{
  "UpstreamHttpMethod": [ "Get" ],   
  "UpstreamPathTemplate": "/v2/Products",   
  "DownstreamPathTemplate": "/v1/Products",
  "DownstreamScheme": "https",
  "Priority": 4 // highest priority, assume we have only 4 routes
},
{
  "UpstreamHttpMethod": [ "Post" ],   
  "UpstreamPathTemplate": "/v2/Products/{id}/SomeAction",   
  "DownstreamPathTemplate": "/v1/Products/{id}/SomePublicAction",   
  "DownstreamScheme": "https", 
  "Priority": 3 // open static routes based on the known suffix
},
{
  "UpstreamHttpMethod": [ "Get", "Post" ], 
  "UpstreamPathTemplate": "/v2/Products/{id}/DeniedRoute",
  "DownstreamPathTemplate": "/unknown", // it is better to point to localhost with fake port, so HTTP connection will fail immediately without real DNS probe
  "DownstreamHostAndPorts": [
    { "Host": "localhost", "Port": 33333 } // use fake closed local port
  ],
  "DownstreamScheme": "https",
  "Priority": 3 // closed static routes based on the known suffix
},
//{ // this is "dynamic" Catch All route because of {all} placeholder at the end
//  "UpstreamHttpMethod": [ "Get", "Post" ], 
//  "UpstreamPathTemplate": "/v2/Products/{id}/{all}",
//  "DownstreamPathTemplate": "/unknown",
//  "DownstreamScheme": "https",
//  "Priority": 2 // closed static routes based on the known suffix
//},
{ // this is Catch All route which should have the lowest priority
  "UpstreamHttpMethod": [ "Get" ],
  "UpstreamPathTemplate": "/v2/Products/{id}",
  "DownstreamPathTemplate": "/v1/Products/{id}",
  "DownstreamScheme": "https", 
  "Priority": 1 // open non-static routes which includes everything
},
{ // this is Catch All route for non-Products routes. No priority at all!
  "UpstreamPathTemplate": "/v2/Orders/{id}",
  "DownstreamPathTemplate": "/v1/Orders/{id}",
}

I assume this solution will work if you know suffixes of paths which you'd like to open/close.

2nd Solution

Develop a Delegating Handler to filter all paths and set up routing similar to configuration:

{ // this is Catch All route for Products
  "UpstreamHttpMethod": [ "Get" ],
  "UpstreamPathTemplate": "/v2/Products/{all}",
  "DownstreamPathTemplate": "/v1/Products/{all}",
  "DownstreamScheme": "https", 
  "Priority": 2, // process Products paths first
  "DelegatingHandlers": [ // your smart path filtering delegate
    "ProductsRoutingFilter",
  ]
}

And very draft version of a delegating handler:

public class ProductsRoutingFilter : DelegatingHandler
{
    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken token)
    {
        if (IsForbidden(request))
        {
            var deniedResponse = new HttpResponseMessage(HttpStatusCode.Forbidden);
            deniedResponse.Content = new StringContent($"Path '{request.RequestUri.PathAndQuery}' is forbidden!");
            return deniedResponse;
        }

        return await base.SendAsync(request, token);
    }

    protected static string[] ForbiddenRoutePatterns = new string[]
    {
        "/v2/Products/{.+}/DeniedRoute",
    };

    private bool IsForbidden(HttpRequestMessage request)
    {
        foreach (var pattern in ForbiddenRoutePatterns)
        {
            var rxp = new Regex(pattern, RegexOptions.Compiled);
            if (rxp.IsMatch(request.RequestUri.PathAndQuery)
            {
                return true;
            }
        }
        return false;
    }
}

Looks good?

[amorelIM]

I tried the second solution and it works fine.
Thank you for your help! 👍🏽