Class BowireTargetPolicy

Namespace
Kuestenlogik.Bowire.Net
Assembly
Kuestenlogik.Bowire.dll

Which targets the server-side endpoints may dial on behalf of a caller.

public sealed class BowireTargetPolicy
Inheritance
BowireTargetPolicy
Inherited Members

Remarks

Every endpoint that opens a connection to a caller-named URL — /api/invoke, /api/invoke/stream, /api/channel/open, /api/services, /api/security/fuzz and the /api/parallel/* runs, /api/network/test — asks this policy before it dials; the auth helpers (token proxies, flow capture) ask ForAuth(BowireOptions?, HttpRequest?). Without it LockServerUrl only made the URL input read-only in the browser, while ?serverUrl=http://169.254.169.254/ still went out from the server: an open relay into whatever network the Bowire host sits in.

The policy is enforced when LockServerUrl is set or AllowedServerUrls is non-empty. Unenforced (the default), every target is allowed, exactly as before. Enforced, a target is allowed when it matches one of:

  • ServerUrl and every entry of ServerUrls — what the UI is locked to;
  • every entry of AllowedServerUrls;
  • in Embedded mode, the host's own origin (the target the endpoints fall back to when no serverUrl is given). It comes from the request's Host header, so a host that is reachable under foreign names should restrict AllowedHosts or set ServerUrl explicitly.

Matching compares normalised URLs, never raw strings: the hint@ prefix is stripped (Parse(string?)), scheme and host are compared case-insensitively, a default port equals its explicit form (http://h = http://h:80), a trailing slash is ignored, and dot segments are resolved. The path of an allowed entry is a base path: the target's path must equal it or continue it after a /, so https://api/v1 allows https://api/v1/users but not https://api/v10. Query and fragment are ignored. A value that is not an absolute scheme:// URL only matches an entry that is the same string (case-insensitive, trailing slash ignored).

Fields

RefusedProblemType

Problem-details type of the 403 a refused target gets.

public const string RefusedProblemType = "urn:bowire:target-not-allowed"

Field Value

string

Properties

IsEnforced

Whether targets are checked at all.

public bool IsEnforced { get; }

Property Value

bool

Unrestricted

A policy that allows every target — what an unlocked host runs with.

public static BowireTargetPolicy Unrestricted { get; }

Property Value

BowireTargetPolicy

Methods

Allows(string?)

Whether the endpoints may dial rawTarget. An empty value names no target (nothing is dialed for it) and is always allowed.

public bool Allows(string? rawTarget)

Parameters

rawTarget string

Returns

bool

For(BowireOptions?, HttpRequest?)

The policy for options. request supplies the embedded host's own origin; it may be null outside a request, in which case that origin is not allowed implicitly.

public static BowireTargetPolicy For(BowireOptions? options, HttpRequest? request = null)

Parameters

options BowireOptions
request HttpRequest

Returns

BowireTargetPolicy

ForAuth(BowireOptions?, HttpRequest?)

The policy for the auth helpers that call identity providers on the caller's behalf — the OAuth token proxies, the custom-token proxy and auth-flow capture. Token endpoints usually live on another host than the API, so they get their own list: AllowedAuthUrls. Enforced when LockServerUrl is set or either allowlist is non-empty; the allowed set is everything For(BowireOptions?, HttpRequest?) allows plus AllowedAuthUrls (a token endpoint on the API host itself needs no extra entry).

public static BowireTargetPolicy ForAuth(BowireOptions? options, HttpRequest? request = null)

Parameters

options BowireOptions
request HttpRequest

Returns

BowireTargetPolicy