Skip to main content
Version: 3.8

uri-blocker

Description#

The uri-blocker Plugin intercepts user requests with a set of block_rules.

Attributes#

NameTypeRequiredDefaultValid valuesDescription
block_rulesarray[string]TrueList of regex filter rules. If the request URI hits any one of the rules, the response code is set to the rejected_code and the user request is terminated. For example, ["root.exe", "root.m+"].
rejected_codeintegerFalse403[200, ...]HTTP status code returned when the request URI hits any of the block_rules.
rejected_msgstringFalsenon-emptyHTTP response body returned when the request URI hits any of the block_rules.
case_insensitivebooleanFalsefalseWhen set to true, ignores the case when matching request URI.

Enable Plugin#

The example below enables the uri-blocker Plugin on a specific Route:

curl -i http://127.0.0.1:9180/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"uri": "/*",
"plugins": {
"uri-blocker": {
"block_rules": ["root.exe", "root.m+"]
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"127.0.0.1:1980": 1
}
}
}'

Example usage#

Once you have configured the Plugin as shown above, you can try accessing the file:

curl -i http://127.0.0.1:9080/root.exe?a=a
HTTP/1.1 403 Forbidden
Date: Wed, 17 Jun 2020 13:55:41 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 150
Connection: keep-alive
Server: APISIX web server

... ...

You can also set a rejected_msg and it will be added to the response body:

HTTP/1.1 403 Forbidden
Date: Wed, 17 Jun 2020 13:55:41 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 150
Connection: keep-alive
Server: APISIX web server

{"error_msg":"access is not allowed"}

Delete Plugin#

To remove the uri-blocker Plugin, you can delete the corresponding JSON configuration from the Plugin configuration. APISIX will automatically reload and you do not have to restart for this to take effect.

curl http://127.0.0.1:9180/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"uri": "/*",
"upstream": {
"type": "roundrobin",
"nodes": {
"127.0.0.1:1980": 1
}
}
}'