How to block Rest API unfiltered queries or API calls without field parameter

Question

How to Identify REST API URL patterns for  below conditions and blocks the request at load balancer  or HA proxy configuration.

* request with unfiltered queries  with all fields search
* calculated fields search

Example- :

missing fields parameter
jira/rest/api/2/search?jql=project=JIRADEV

fields parameter requests all
jira/rest/api/2/search?fields=*all&jql=project=JIRADEV

no parameters 
jira/rest/api/2/search

unknown · Answer

This is what worked for me:

acl PATH_1 path_beg -i /rest/api/2/search
acl check_param url_sub fields=
acl field_all urlp_sub(fields) all
http-request deny deny_status 405 if PATH_1 !check_param
http-request deny deny_status 405 if PATH_1 field_all
http-request deny deny_status 405 if PATH_1 { url_param(fields) -m len eq 0 }

unknown · Answer

Dear @Thomas Deiler  , Thanks for reply. Yes. However  I am looking for URL rewriting with multiple condition . If the the request is API request  and the request does not contains a specific  field parameter then it will be blocked at HA proxy or do a URL rewrite by replacing the url_param

example of pseudo code:

var default_fields_param = "type,summary,status,components,versions,fixVersions,resolution,customfield_13232"

if URL contains "rest/api/2/search" // it is a call to the Jira REST API, search method
{
if  url_param(field)=*all" // caller is specifically requesting all fields -- do not allow this
{
url_param(field)=${var default_fields_param}

}

if NOT  parameter contains "fields=" // call does not include a fields param - not allow this
{
append "&fields=" + default_fields_param  // or deny

}

However I am going to read the document and see if i can frame a ACL.

Thomas Deiler_db00h3 · Answer

Dear @[deleted],

I think, what you are looking for is ACLs for HAProxy.

So long

Thomas