Fluent.Backdoor 1.0.16

Fluent.Backdoor

If you need to keep your app services on a tight leash, while still being able to verify app slots using smoke tests and perhaps warmups, then this could help you. A need based on keeping an app-service url hidden, while warming up a production slot in Azure made me create this little configurable function.

The syntax is:

1. What do we Require() (IP/Cookie/Queystring)? And if fulfilled:
2. how long will it Allow() access?

Simple, right?

Multiple Require() can be chained together for more complex rules.

In the end a ReturnCodeWhenDenied() is used to tell the system what to show when it fails. Only one ReturnCodeWhenDenied() is allowed.

Sample usage of Fluent.Backdoor

Startup.cs

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
var options = new RewriteOptions();

var fluent = new BackdoorRule().AllowAnythingFor(2)
    .Require(new BackdoorMagicQuerystring
    {
        QuerystringName = Configuration["FluentBackDoorRules:FluentMagicQuerystring:QuerystringName"],
        QuerystringValue = Configuration["FluentBackDoorRules:FluentMagicQuerystring:QuerystringValue"]
    }).AndAllowFor(new TimeSpan(0, 0, 10))
    .Require(new BackdoorMagicCookie()
    {
        CookieName = Configuration["FluentBackDoorRules:FluentMagicCookie:CookieName"],
        CookieValue = Configuration["FluentBackDoorRules:FluentMagicCookie:CookieValue"]
    })
    .Require(new BackdoorMagicCookie()
    {
        CookieName = "hey",
        CookieValue = "ho"
    }).AndAllowFor(new TimeSpan(0, 0, 20))
    .Require(new BackdoorHttpHostAndRemoteIPAddress
    {
        HostNamesToProtect = Configuration["FluentBackDoorRules:FluentMagicRegExHttpHost_RemoteAddr:HostNamesToProtect"],
        IPAddressesToAllowToUseProtectedUrls = Configuration["FluentBackDoorRules:FluentMagicRegExHttpHost_RemoteAddr:IPAddressesToAllowToUseProtectedUrls"]
    }).AndAllowForever()
    .ReturnCodeWhenDenied(System.Net.HttpStatusCode.Unauthorized);

options.Rules.Add(fluent);
app.UseRewriter(options);
}

appsettings.json

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft": "Warning",
      "Microsoft.Hosting.Lifetime": "Information"
    }
  },
  "AllowedHosts": "*",
  "FluentBackDoorRules": {
    "CompleteAccess": {
      "TimeAllowedInSeconds": 20
    },
    "FluentMagicCookie": {
      "CookieName": "cookieshallpass",
      "CookieValue": "xxx"
    },
    "FluentMagicQuerystring": {
      "QuerystringName": "querystringshallpass",
      "QuerystringValue": "xxx"
    },
    "FluentMagicRegExHttpHost_RemoteAddr": {
      "HostNamesToProtect": "inte\\.|prep\\.|-slot\\.|prod\\.|stage\\.|stage2\\.|www2\\.",
      "IPAddressesToAllowToUseProtectedUrls": "^5\\.6\\.7\\8.$"
    }
  }
}

Explanation of what sample code above will do:

1. Allow any calls to the app 2 times.
2. Allow access to the app for 10 seconds if a querystring is supplied.
3. Allow access to the app for 20 seconds if two different cookies are present.
4. Restrict access to the app IF the HTTP_HOST contains HostNamesToProtect, IE. the secret app service url:s using RegEx-matching AND the visitor is NOT in the list of IPAddressesToAllowToUseProtectedUrls (REMOTE_ADDR).