Fluent.Backdoor 1.0.6

Fluent.Backdoor

If you need to keep your app services on a tight leash, while still being able to verify app slots using smoke tests and perhaps warmups, then this could help you. A need based on keeping an app-service url hidden, while warming up a production slot in Azure made me create this little configurable function.

Sample usage of Fluent.Backdoor

        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            var options = new RewriteOptions();


            var fluent = new BackdoorRule().AllowAnythingFor(2)
                .Require(new BackdoorMagicCookie()
                {
                    CookieName = Configuration["CookieName"],
                    CookieValue = Configuration["CookieValue"]
                })
                .Require(new BackdoorMagicCookie()
                {
                    CookieName = "hey",
                    CookieValue = "ho"
                }).AndAllowFor(new TimeSpan(0, 0, 10))
                .Require(new BackdoorMagicQuerystring
                {
                    QuerystringName = Configuration["QuerystringName"],
                    QuerystringValue = Configuration["QuerystringValue"]
                }).AndAllowFor(new TimeSpan(0, 0, 20))
                .Require(new BackdoorMagicQuerystring
                {
                    QuerystringName = "hey",
                    QuerystringValue = "ho"
                }).AndAllowFor(new TimeSpan(0, 0, 20))
                .Require(new BackdoorHttpHostAndRemoteIPAddress
                {
                    HostNamesToProtect = Configuration["HostNamesToProtect"],
                    IPAddressesToAllowToUseProtectedUrls = Configuration["IPAddressesToAllowToUseProtectedUrls"]
                }).AndAllowFor(new TimeSpan(0, 0, 60))
                .ReturnCodeWhenDenied(System.Net.HttpStatusCode.Unauthorized)
                .Finalize();

            options.Rules.Add(fluent);
            app.UseRewriter(options);
        }

Example code above will:

1. Allow any calls to the app 2 times.
2. Allow access to the app for 10 second if two different cookies are present.
3. Allow access to the app for 20 seconds if a querystring is supplied.
4. Restrict access to the app if the HTTP_HOST contains HostNamesToProtect (RegEx-matching) and NOT in then list of IPAddressesToAllowToUseProtectedUrls (Remote_Addr).

The syntax is:

1. What is Require() and if fulfilled,
2. how long it will Allow() access.

Simple, right?

In the end a ReturnCodeWhenDenied and Finally is used to wrap it up.