Add parameters to back-end url

[radlik01]

Is it possible to add some parameters or replace some part of url before sending it to back-end ?
I need to send some confidential data to back-end in url (get REST API) but I cannot use this parameters from public internet.
The confidential data are in token or in headers (i put some data fro token to header before sending request to back-end ).

public call:
https://server/apiman-gateway/portal_pacient/vaccination_calendar/1.0/cs/api/CalendarEvent/

change to back-end
https://server/apiman-gateway/portal_pacient/vaccination_calendar/1.0/cs/api/CalendarEvent/{patientId}

What is the best way to do it ?

Thank you

Jan

[volkflo]

Hi,

the simplest solution would be to use one of our policies.

• https://www.apiman.io/apiman-docs/user-guide/2.1.0.Final/gateway/policies.html#_url_rewriting_policy
  • This would allow you to rewrite the URL
• https://www.apiman.io/apiman-docs/user-guide/2.1.0.Final/gateway/policies.html#_simple_header_policy
  • If the backend allows Headers this would help to send the data as a header.

I think the only problem is, that these are all fixed values.
Your patientIdseems to be a dynamic value?

[volkflo]

Maybe it would be a cool addition to an existing policy:
Something that forwards headers or cliam values as query parameters instead of only pass them along.

[radlik01]

I will do something like that
` String origDestination = request.getDestination();
String newDestination = request.getDestination();

for (Map.Entry<String, String> consumer: request.getHeaders().getEntries()) {
  if (sLog.isDebugEnabled()) {
    sLog.debugf("doApply header key=value %s=%s", consumer.getKey(), consumer.getValue());
  }
  newDestination = newDestination.replaceAll("[{" + consumer.getKey() + "}]", consumer.getValue());
}

request.setDestination(newDestination);
if (sLog.isDebugEnabled()) {
  sLog.debugf("doApply after change destination %s %s", origDestination, newDestination);
}
if (successStatus.getValue()) {
  chain.doApply(request);
}`

[radlik01]

Yes existing Simple Header policy will be the best

[msavy]

Something like that -- although you'd want to select the specific headers you're targeting (or extract from JWT), because there are loads of other HTTP headers which will not be relevant to your purposes 👍.

[radlik01]

Yes. I could put to config that only headers starting with X- should be processing

I have already deploy the plugin to test env and it seams that is working like a charm.

Thank you

[msavy]

Answer was to write a custom policy plugin. Please refer to the comments here.