Fluent.Backdoor 1.0.8

Fluent.Backdoor

If you need to keep your app services on a tight leash, while still being able to verify app slots using smoke tests and perhaps warmups, then this could help you. A need based on keeping an app-service url hidden, while warming up a production slot in Azure made me create this little configurable function.

The syntax is:

1. What do we Require() (IP/Cookie/Queystring)? And if fulfilled:
2. how long will it Allow() access?

Simple, right?

Multiple Require() can be chained together for more complex rules.

In the end a ReturnCodeWhenDenied() and Finally() is used to wrap it up.

Sample usage of Fluent.Backdoor

        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            var options = new RewriteOptions();

            var fluent = new BackdoorRule().AllowAnythingFor(2)
                .Require(new BackdoorMagicCookie()
                {
                    CookieName = Configuration["FluentBackDoorRules:FluentMagicCookie:CookieName"],
                    CookieValue = Configuration["FluentBackDoorRules:FluentMagicCookie:CookieValue"]
                })
                .Require(new BackdoorMagicCookie()
                {
                    CookieName = "hey",
                    CookieValue = "ho"
                }).AndAllowFor(new TimeSpan(0, 0, 10))
                .Require(new BackdoorMagicQuerystring
                {
                    QuerystringName = Configuration["FluentBackDoorRules:FluentMagicQuerystring:QuerystringName"],
                    QuerystringValue = Configuration["FluentBackDoorRules:FluentMagicQuerystring:QuerystringValue"]
                }).AndAllowFor(new TimeSpan(0, 0, 20))
                .Require(new BackdoorMagicQuerystring
                {
                    QuerystringName = "hey",
                    QuerystringValue = "ho"
                }).AndAllowFor(new TimeSpan(0, 0, 20))
                .Require(new BackdoorHttpHostAndRemoteIPAddress
                {
                    HostNamesToProtect = Configuration["FluentBackDoorRules:FluentMagicRegExHttpHost_RemoteAddr:HostNamesToProtect"],
                    IPAddressesToAllowToUseProtectedUrls = Configuration["FluentBackDoorRules:FluentMagicRegExHttpHost_RemoteAddr:IPAddressesToAllowToUseProtectedUrls"]
                }).AndAllowFor(new TimeSpan(TimeSpan.MaxValue.Ticks))
                .ReturnCodeWhenDenied(System.Net.HttpStatusCode.Unauthorized)
                .Finalize();

            options.Rules.Add(fluent);
            app.UseRewriter(options);
        }

appsettings.json

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft": "Warning",
      "Microsoft.Hosting.Lifetime": "Information"
    }
  },
  "AllowedHosts": "*",
  "FluentBackDoorRules": {
    "CompleteAccess": {
      "TimeAllowedInSeconds": 20
    },
    "FluentMagicCookie": {
      "CookieName": "cookieshallpass",
      "CookieValue": "xxx"
    },
    "FluentMagicQuerystring": {
      "QuerystringName": "querystringshallpass",
      "QuerystringValue": "xxx"
    },
    "FluentMagicRegExHttpHost_RemoteAddr": {
      "HostNamesToProtect": "inte\\.|prep\\.|-slot\\.|prod\\.|stage\\.|stage2\\.|www2\\.",
      "IPAddressesToAllowToUseProtectedUrls": "^5\\.6\\.7\\8.$"
    }
  }
}

Example code above will:

1. Allow any calls to the app 2 times.
2. Allow access to the app for 10 second if two different cookies are present.
3. Allow access to the app for 20 seconds if a querystring is supplied.
4. Restrict access to the app if the HTTP_HOST contains HostNamesToProtect (RegEx-matching) and NOT in then list of IPAddressesToAllowToUseProtectedUrls (Remote_Addr).