A reverse proxy for filtering requests using user defined policies.
Requests are only forwarded to a target if they are allowed by a policy, therefore matching it's url path and rule. Rules are written in CEL (Common Expression Language) and can rejected requests based on request metadata like url parameters and query, request headers, i.e.
[{
"path": "/v1/users/{firstname}",
"expr": "url.params[\"firstname\"] == \"grace\" && req.header[\"lastname\"][0] == \"hopper\"",
}]The policy proxy can be build using a recent Go toolchain and started by providing a target url and policies file.
go build -o policy-proxy ./cmd/proxy
./policy-proxy --target-url=https://example.com --policies-file=./policies.jwcc
The proxy can be configured through the following command-line flags
--listen-addr (default :8000):
Address to listen for incoming requests to the proxy.
--metrics-addr (default :4000): Address to expose Prometheus /metrics endpoint on.
--policies-file:
Path to file containing request policies written in JWCC.
--target-url:
Base URL of target where requests are being forwarded to. If the URL
contains a path element it will be prepended to the path inside of a policy.
The polices file is written in JWCC (JSON with Commas and Comments) using the following format.
[{
// url path pattern to match requests against
"path": string,
// cel programm for validating request metadata
"rule": string,
} ... ]
A policy's rule is a CEL programm with access to the following request metadata in it's environment.
req.header (map[string][]string):
HTTP headers of request.
url.params (map[string]string):
URL parameters by name (defined inside the policy's path).
url.path (string):
URL path of the request.
url.query (map[string][]string):
URL query of request.
The policy proxy exposes the following metrics in Prometheus formate under a
seperate address under the /metrics enpoint.
http_request_total (Counter):
Total number of HTTP requests.
http_request_duration_seconds (Histogram):
Histogram of latencies for HTTP request in seconds.
http_request_denied_total (Counter):
Total number of denied HTTP requests.
http_request_in_flight (Gauge):
Number of HTTP requests currently serving.
This project is under MIT license.