How to block Rest API unfiltered queries or API calls without field parameter

[Makareswar Rout]

How to Identify REST API URL patterns for  below conditions and blocks the request at load balancer  or HA proxy configuration.

• request with unfiltered queries  with all fields search
• calculated fields search

Example- : 

missing fields parameter
jira/rest/api/2/search?jql=project=JIRADEV

fields parameter requests all
jira/rest/api/2/search?fields=*all&jql=project=JIRADEV

no parameters 
jira/rest/api/2/search

[Thomas Deiler]

Dear @Makareswar Rout ,

I think, what you are looking for is ACLs for HAProxy.

So long

Thomas

[Makareswar Rout]

Dear @Thomas Deiler  , Thanks for reply. Yes. However  I am looking for URL rewriting with multiple condition . If the the request is API request  and the request does not contains a specific  field parameter then it will be blocked at HA proxy or do a URL rewrite by replacing the url_param

example of pseudo code:

var default_fields_param = "type,summary,status,components,versions,fixVersions,resolution,customfield_13232"

if URL contains "rest/api/2/search" // it is a call to the Jira REST API, search method
{
if  url_param(field)=*all" // caller is specifically requesting all fields -- do not allow this
{
url_param(field)=${var default_fields_param}

}

if NOT  parameter contains "fields=" // call does not include a fields param - not allow this
{
append "&fields=" + default_fields_param  // or deny

}

However I am going to read the document and see if i can frame a ACL.

[Makareswar Rout]

This is what worked for me:  

acl PATH_1 path_beg -i /rest/api/2/search
acl check_param url_sub fields=
acl field_all urlp_sub(fields) all
http-request deny deny_status 405 if PATH_1 !check_param
http-request deny deny_status 405 if PATH_1 field_all
http-request deny deny_status 405 if PATH_1 { url_param(fields) -m len eq 0 }