Stax.UserAgentBasedRouteBlocking 1.1.0

dotnet add package Stax.UserAgentBasedRouteBlocking --version 1.1.0                
NuGet\Install-Package Stax.UserAgentBasedRouteBlocking -Version 1.1.0                
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="Stax.UserAgentBasedRouteBlocking" Version="1.1.0" />                
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add Stax.UserAgentBasedRouteBlocking --version 1.1.0                
#r "nuget: Stax.UserAgentBasedRouteBlocking, 1.1.0"                
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
// Install Stax.UserAgentBasedRouteBlocking as a Cake Addin
#addin nuget:?package=Stax.UserAgentBasedRouteBlocking&version=1.1.0

// Install Stax.UserAgentBasedRouteBlocking as a Cake Tool
#tool nuget:?package=Stax.UserAgentBasedRouteBlocking&version=1.1.0                

User Agent Based Route Blocking


Summary

This NuGet library allows you to block certain routes based on whether or not they have a certain user agent. It is a very simple way of doing API based authorisation. It also has the ability to allow certain referrers through, which can help enable your swagger to work for example, or help limit user agents coming from a certain site.

An example might be you want to limit anyone from hitting https://api.example.com/v1/create-user.json unless they have the user agent EXAMPLE.COM-FRONTEND which your front end client sends. You could then also only allow requests with that user agent from https://example.com and also https://api.example.com (the latter which would allow your swagger to work for example).

How to use

Configuration is set through your appsettings.json (or you can inject as environment variables).

Some how to use notes

  • The path check does a "starts with" check. Meaning to protect https://api.example.com/v1 you would enter in UserAgentBasedRouteBlocking:Paths "/v1". This also means it acts like a wildcard meaning anything which starts with "/v1" is protected. Eg: /v1/create.json, /v1/upload.json etc
  • User agent does a contains check, meaning Mozilla would cover Mozilla 5.0 - Linux for example.
  • Referrer does a "contains" check, meaning https://example.com/a-page would be covered by setting https://example.com in your config

In your appsettings.json you need a structure of:

{
  "UserAgentBasedRouteBlocking": {
    "Paths": [
      LIST
      OF
      PATHS
      TO
      CHECK
    ],
    "Referrer": {
      "AllowAll": bool - optional defaults to false,
      "Allowed": [
        LIST
        OF
        ALLOWED
        REFERRERS
      ]
    },
    "UserAgent": {
      "AllowAll": bool - optional defaults to false,
      "Allowed": [
        LIST
        OF
        ALLOWED
        USER
        AGENTS
      ]
    }
  }
}

Below is an example which:

  • Checks the paths, /v1/hello-world.json, /v1/diagnostics and /v2
    • It is important to note that this checks the start of the route, so for example /v2/api.json would be covered by /v2
  • Allows requests from https://google.com, https://facebook.com, https://apiconsumer.com
  • Allows requests from user agents API Consumer User Agent and API Consumer2 User Agent
{
  "UserAgentBasedRouteBlocking": {
    "Paths": [
      "/v1/hello-world.json",
      "/v1/diagnostics",
      "/v2/"
    ],
    "Referrer": {
      "AllowAll": false,
      "Allowed": [
        "https://google.com",
        "https://facebook.com",
        "https://apiconsumer.com"
      ]
    },
    "UserAgent": {
      "AllowAll": false,
      "Allowed": [
        "API Consumer User Agent",
        "API Consumer2 User Agent"
      ]
    }
  }
}

As you have provided allowed lists for user agents and referrers, you do not need to set the AllowAll property for each.

Product Compatible and additional computed target framework versions.
.NET net6.0 is compatible.  net6.0-android was computed.  net6.0-ios was computed.  net6.0-maccatalyst was computed.  net6.0-macos was computed.  net6.0-tvos was computed.  net6.0-windows was computed.  net7.0 was computed.  net7.0-android was computed.  net7.0-ios was computed.  net7.0-maccatalyst was computed.  net7.0-macos was computed.  net7.0-tvos was computed.  net7.0-windows was computed.  net8.0 was computed.  net8.0-android was computed.  net8.0-browser was computed.  net8.0-ios was computed.  net8.0-maccatalyst was computed.  net8.0-macos was computed.  net8.0-tvos was computed.  net8.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last updated
1.1.0 888 1/16/2023
1.0.1-beta 206 12/24/2022
1.0.0-beta 152 12/24/2022