request-validation.md

description
This page provides the technical details of the Request Validation policy

Request Validation

Overview

You can use the request-validation policy to validate an incoming HTTP request according to defined rules. A rule is defined for an input value. This input value supports Expression Language expressions and is validated against constraint rules. By default, if none of the rules can be validated, the policy returns a 400 status code.

Functional and implementation information for the request-validation policy is organized into the following sections:

• Examples
• Configuration
• Compatibility Matrix
• Errors
• Changelogs

Examples

{% hint style="warning" %} This policy can be applied to v2 APIs and v4 proxy APIs. It cannot be applied to v4 message APIs. {% endhint %}

{% tabs %} {% tab title="Proxy API example" %} Sample policy configuration:

"policy-request-validation": {
    "rules": [
        {
            "constraint": {
                "parameters": [
                    ".*\\\\.(txt)$"
                ],
                "type": "PATTERN"
            },
            "input": "{#request.pathInfos[2]}"
        }
    ],
    "status": "400"
}

{% endtab %} {% endtabs %}

Configuration

The request-validation policy supports the following constraint rules:

Constraint	Description
NOT_NULL	Input value is required
MIN	Input value is a number and its value is greater than or equal to a given parameter
MAX	Input value is a number and its value is lower than or equal to a given parameter
MAIL	Input value is valid according to the mail pattern
DATE	Input value is valid according to the date format pattern given as a parameter
PATTERN	Input value is valid according to the pattern given as a parameter
SIZE	Input value length is between two given parameters
ENUM	Field value included in ENUM

Phases

The phases checked below are supported by the request-validation policy:

v2 Phases	Compatible?	v4 Phases	Compatible?
onRequest	true	onRequest	true
onResponse	false	onResponse	false
onRequestContent	true	onMessageRequest	false
onResponseContent	false	onMessageResponse	false

Options

The request-validation policy can be configured with the following options:

Property	Required	Description	Type	Default
scope	true	Phase when the policy is executed	Policy scope	ON_REQUEST
status	true	HTTP status code send to the consumer in case of validation issues	HTTP status code	400
rules	true	Rules to apply to incoming request	List of rules	-

Compatibility matrix

The following is the compatibility matrix for APIM and the request-validation policy:

Plugin Version	Supported APIM versions
1.x	All

Errors

HTTP status code	Message
400	Incoming HTTP request can not be validated.

You can use the response template feature to override the default response provided by the policy. These templates must be defined at the API level (see the API Console Response Templates option in the API Proxy menu).

The error keys sent by this policy are as follows:

Key	Parameters
REQUEST_VALIDATION_INVALID	violations

Changelogs

{% @github-files/github-code-block url="https://github.com/gravitee-io/gravitee-policy-request-validation/blob/master/CHANGELOG.md" %}