How To Apply Transform To Only One Destination

[farukterzioglu]

I want to apply transform only to one of the destinations.
I am load balancing between two destinations, one of them require a Bearer token (could be also another header).
Right now I am able to transform requests and send the Bearer token to the destinations. But I am doing the transformation on route.
When the request is load balanced to the destination2 (which doesn't require auth), destination2 also gets the same header value.
This can leak the auth token of destination1 to the destination2.

How can I apply this transform (adding header) only to the destination1.

What have I done;
I created a route and a cluster just for destination1. I applied the transformation on this specific route.
Then I load balanced between destination2 and the proxy itself. For destination1, proxy routes to its own route.
I created this specific route with path prefix, so it will be matched before the more generic route.

This works, but I will need more transformations specific to the some destinations. (like adding path suffix, query string etc.)
I will need to create lots of specific routes just to be able to apply transform for only those destinations.

Is there a way to improve this process? I guess I can do this with code, like creating conditions in the code and adding the header for only destination one, but it will require lots of customisation.
I prefer to do it in the config.
Is there a way to apply transform on destination level, instead of route level.

Config of what I have done;

{
  "Urls": "http://localhost:5000",
  "ReverseProxy": {
    "Routes": {
      "route-destination1": {
        "ClusterId": "cluster-destination1",
        "Match": {
          "Path": "/destination1/{**catch-all}"
        },
        "Transforms": [
          {
            "PathRemovePrefix": "/destination1"
          },
          {
            "RequestHeader": "Authorization",
            "Append": "Bearer SOMEBEARERTOKEN"
          }
        ]
      },
      "route1": {
        "ClusterId": "cluster1",
        "Match": {
          "Path": "{**catch-all}"
        }
      }
    },
    "Clusters": {
      "cluster1": {
        "LoadBalancingPolicy": "RoundRobin",
        "Destinations": {
          "dest1": {
            "Address": "http://localhost:5000/destination1"
          },
          "dest2": {
            "Address": "https://dest2.org"
          }
        }
      },
      "cluster-destination1": {
        "Destinations": {
          "destination": {
            "Address": "https://dest1-with-auth.net"
          }
        }
      }
    }
  }
}

[Tratcher]

Clusters are supposed to contain equivalent destinations that are all capable of handling the requests. How is it that one destination requires an auth header and the other doesn't? What else is different about these destinations?

Some other ways to do this:

A) Instead of load balancing, use separate clusters and select the cluster dynamically:
https://microsoft.github.io/reverse-proxy/articles/ab-testing.html
https://microsoft.github.io/reverse-proxy/api/Microsoft.AspNetCore.Http.HttpContextFeaturesExtensions.html#Microsoft_AspNetCore_Http_HttpContextFeaturesExtensions_ReassignProxyRequest_HttpContext_Yarp_ReverseProxy_Model_RouteModel_Yarp_ReverseProxy_Model_ClusterState_

B) Use direct forwarding to choose the destination and pass in the transforms required for each separately.
https://microsoft.github.io/reverse-proxy/articles/direct-forwarding.html

[farukterzioglu]

My destinations are different SaaS providers. Each provider requires different authentication methods.

• Some require the auth token from url path, e.g.:www.saasprovider1.com/some-auth-token. No problem with this, because it only affects one destination.
• Some require it with query string, e.g.: www.saasprovider2.com?auth=some-auth-token. This is problematic too. It needs the transform QueryValueParameter, which also applies to all destinations. I can't set the address with query string param, because applications add sub url paths.

{
            "QueryValueParameter": "auth",
            "Append": "some-auth-token"
}

• Some require it within headers, this is possible with a transform as below. But this also applies to all destinations.

{
            "RequestHeader": "Authorization",
            "Append": "Bearer some-auth-token"
}

Not related to the problem, but my destinations are blockchain node providers.

[farukterzioglu]

I want to be able to make health checks and load balance between destinations like;

• www.saasprovider1.com/some-auth-token1
• www.saasprovider2.com?auth=some-auth-token2
• www.saasprovider3.com --header 'Authorization: Bearer some-auth-token3'

All destinations run the same application (blockchain node), and accept the same requests.

[Tratcher]

Curious. The transform infrastructure isn't designed for this level of granularity, nor do they apply to health checks. I think your best option is to use a DelegatingHandler that checks the Url and modifies the request accordingly. That would work for both requests and health checks.
https://microsoft.github.io/reverse-proxy/articles/http-client-config.html#custom-iforwarderhttpclientfactory

reverse-proxy/src/ReverseProxy/Forwarder/ForwarderHttpClientFactory.cs

Line 131 in bd289ed

protected virtual HttpMessageHandler WrapHandler(ForwarderHttpClientContext context, HttpMessageHandler handler)

[farukterzioglu]

I took an alternative approach, I added metadata in destinations that require authentication.
And in a custom transformation, I added header values if there is a definition for selected destination.

My config;

"Clusters": {
  "cluster1": {
    "Destinations": {
      "destination1": {
        "Address": "https://destination1.org"
      },
      "destination2_withAuth": {
        "Address": "https://destination2.net",
        "Metadata": {
          "RequestHeader.Append[0]": "Authorization=Bearer SOME_BEARER_TOKEN",
          "RequestHeader.Append[1]": "SOME_OTHER_KEY=SOME_OTHER_VALUE"
        }
      }
    }
  }
}

Transform;

.AddTransforms(transformBuildContext =>
{
    transformBuildContext.AddRequestTransform(transformContext =>
    {
        var features = transformContext.HttpContext.GetReverseProxyFeature();
        var proxiedDestination = features.ProxiedDestination;

        if (proxiedDestination != null)
        {
            var destinationMetadata = transformBuildContext.Cluster!.Destinations![proxiedDestination.DestinationId].Metadata;
            if (destinationMetadata != null)
            {
                var appendedList = destinationMetadata.Where(x => x.Key.StartsWith("RequestHeader.Append"));
                foreach (var append in appendedList)
                {
                    var appended = append.Value;
                    if (!string.IsNullOrEmpty(appended))
                    {
                        var header = appended.Split('=');
                        transformContext.ProxyRequest.Headers.Add(header[0], header[1]);
                    }
                }
            }
        }
        return default;
    });
}

[farukterzioglu]

Right now this works. Sure there can be improvements.
@Tratcher Do you see a problem with this approach?

[Tratcher]

Huh, I'd not considered using GetReverseProxyFeature inside a transform. Nice.

Destinations can also have metadata, so you could simplify this by moving it in there.

[farukterzioglu]

I actually figured recently metadata of destinations, and updated my solution according to that a while ago.
It is interesting you saw the previous version.

[farukterzioglu]

Because health checks are in the destinations, transformations in the route didn't apply for health checks.
For the destinations that require authentication, I still need to pass authentication details while health checking.
For this I needed to override default ProbingRequestFactory. As in here