Mirror production traffic to a test origin with Functions

In this tutorial, you will build a function that copies production requests to a test origin. The copy lets new software answer real requests before it serves users. You will create the function, instantiate it on a firewall, and trigger it with a Rules Engine rule. Then you will read the mirrored responses in Real-Time Events.

Prerequisites

An Azion account. To create one, refer to How to create an account on Azion.
The Edit Functions permission on the account. It also requires the permission View Functions.
The Edit Firewall permission on the account. It also requires the permission View Firewall. Refer to Teams Permissions.
An application that receives production traffic, on a domain you control. To configure the domain, refer to Add a custom domain to a workload.
A firewall associated with that domain. To create one, refer to Set a firewall’s main settings.
A test origin that answers over HTTPS.

1. Create the traffic mirroring function

A function runs on a firewall when it exports a firewall handler. To create the function:

Open the Functions page

Access Azion Console > Products Menu > Libraries > Functions.

Select + Function

Name the function

Enter a name for the function. For example: traffic-mirroring.

Paste the code in the Code tab

In the Code tab, paste the following code:

JavaScript

01const TEST_ORIGIN = 'example.com';

02const TEST_TIMEOUT = 5000;

04async function mirror(testUrl, options) {

05 try {

06 const start = Date.now();

07 const response = await fetch(testUrl, options);

08 const seconds = (Date.now() - start) / 1000;

10 console.log(`[${response.status}, ${seconds}s]`);

12 if (response.status > 399) {

13 console.warn(

14 JSON.stringify({

15 request_method: options.method,

16 request_path: new URL(testUrl).pathname,

17 request_headers: options.headers,

18 request_body: options.body,

19 response_status: response.status,

20 response_body: await response.text(),

21 response_time: seconds,

22 })

23 );

24 }

25 } catch (error) {

26 if (error.name === 'TimeoutError') {

27 console.warn('Test origin timeout');

28 } else {

29 console.warn(`Error: ${error.message}`);

30 }

31 }

32}

34export default {

35 firewall: async (request, env, ctx) => {

36 const originalUrl = new URL(request.url);

37 const testUrl = `${originalUrl.protocol}//${TEST_ORIGIN}${originalUrl.pathname}${originalUrl.search}`;

39 const options = {

40 method: request.method,

41 headers: Object.fromEntries(request.headers),

42 signal: AbortSignal.timeout(TEST_TIMEOUT),

43 };

45 // A request body can be read once, so read it before the copy starts.

46 if (request.body) {

47 options.body = await request.text();

48 }

50 // waitUntil keeps the copy off the request path.

51 ctx.waitUntil(mirror(testUrl, options));

52 },

53};

Replace the test origin

Replace example.com with the domain of your test origin.

Select Save

The function is saved and available to instantiate on a firewall.

ctx.waitUntil() extends the execution past the point where the handler returns. The copy therefore leaves the request path, and the original request reaches the production origin with no added latency. The handler never calls ctx.deny(), so no request is blocked. AbortSignal.timeout() ends a copy after 5 seconds, and a slower test origin needs a higher value.

The sample uses the ES Modules pattern. To move a function from the Service Worker pattern to this one, refer to Migrate handler patterns in Functions.

2. Instantiate the function on the firewall

A function instance binds the function to one firewall, and a firewall runs a function only with the Functions module turned on. To create the instance:

Open the firewall

In Azion Console, go to Products Menu > Firewall > your firewall.

In the Main Settings tab, turn on the Functions module

Select Save

Go to the Functions Instances tab

Select + Function Instance

Name the instance

Enter a name for the instance. For example: traffic-mirroring instance.

Select the function

Select the traffic-mirroring function. Only functions whose Initiator Type is set to Firewall appear in the list.

Select Save

The instance appears in the Functions Instances tab. It does not run until a Rules Engine rule selects it.

3. Add the rule that runs the function

A Rules Engine rule sets the criteria that trigger the instance. To mirror the requests whose URI starts with /api:

Go to the Rules Engine tab

In the same firewall, go to the Rules Engine tab.

Select + Rule

Name the rule

Enter a name for the rule. For example: Mirror traffic to the test origin.

Select the variable in the Criteria section

In the Criteria section, select the Request URI variable.

Select starts with as the comparison operator

Enter the argument

Enter /api as the argument.

In the Behaviors section, select Run Function

Select the instance you created

Select Save

The rule runs the instance on every request whose URI starts with /api. Changes can take a few minutes to propagate. Wait before you send a request that matches the criteria.

Every request the rule matches produces a second request to the test origin. A criterion of matches regex with .* mirrors all traffic. Widen the criteria only when the test origin absorbs the added volume.

4. Verify the mirrored requests in Real-Time Events

Send a request that matches the rule criteria:

curl https://<your-domain>/api/

The firewall runs the instance on that request, and the function sends a copy to the test origin. To read what the test origin answered:

Open Real-Time Events

Access Azion Console > Real-Time Events.

Select the Functions Console tab

Use the filters to narrow the query

Select an entry to see its details

A copy that succeeds logs the status of the test origin and its response time:

[200, 0.142s]

A response above 399 logs the request and the response as JSON, so the failure carries its own context. A copy that exceeds the timeout logs Test origin timeout.

Read the entries against four measures:

Response time: how the latency of the test origin compares with production.
Error rate: how many entries carry a 4xx or 5xx status.
Timeout frequency: how often a copy exceeds the timeout.
Request coverage: whether the test origin answers every method the rule matches, including POST, PUT, and DELETE.

When the test origin answers production traffic inside your latency and error budget, it is ready to serve production.

Do not await mirror() inside the handler. Pass it to ctx.waitUntil() instead. A handler that awaits mirror() holds every user request until the test origin answers.

5. (Optional) Set the test origin from an environment variable

Environment variables hold the test origin and the timeout outside the code, so one function serves several tests. To read both values from the environment:

Create the environment variables

Create TEST_ORIGIN and TEST_TIMEOUT on the function, as described in Environment variables.

Replace the code in the Code tab

In the Code tab, replace the code with the following:

JavaScript

01const DEFAULT_TIMEOUT = 10000;

03async function mirror(testUrl, options) {

04 try {

05 const start = Date.now();

06 const response = await fetch(testUrl, options);

07 const seconds = (Date.now() - start) / 1000;

09 console.log(`[${response.status}, ${seconds}s]`);

11 if (response.status > 399) {

12 console.warn(

13 JSON.stringify({

14 request_method: options.method,

15 request_path: new URL(testUrl).pathname,

16 request_headers: options.headers,

17 request_body: options.body,

18 response_status: response.status,

19 response_body: await response.text(),

20 response_time: seconds,

21 })

22 );

23 }

24 } catch (error) {

25 if (error.name === 'TimeoutError') {

26 console.warn('Test origin timeout');

27 } else {

28 console.warn(`Error: ${error.message}`);

29 }

30 }

31}

33export default {

34 firewall: async (request, env, ctx) => {

35 const testOrigin = Azion.env.get('TEST_ORIGIN');

36 const testTimeout = Number(Azion.env.get('TEST_TIMEOUT')) || DEFAULT_TIMEOUT;

38 const originalUrl = new URL(request.url);

39 const testUrl = `${originalUrl.protocol}//${testOrigin}${originalUrl.pathname}${originalUrl.search}`;

41 const options = {

42 method: request.method,

43 headers: Object.fromEntries(request.headers),

44 signal: AbortSignal.timeout(testTimeout),

45 };

47 // A request body can be read once, so read it before the copy starts.

48 if (request.body) {

49 options.body = await request.text();

50 }

52 // waitUntil keeps the copy off the request path.

53 ctx.waitUntil(mirror(testUrl, options));

54 },

55};

Azion.env.get() returns the value of a key at run time. When TEST_TIMEOUT carries no value, the function falls back to 10000 ms.

Select Save

The function reads the test origin at run time, so the next test origin needs no code edit.

Next steps

Run a function on a firewallThe same three objects for any firewall function, from the function to the rule that triggers it.Instantiate a function on a firewallCreate the instance from the Azion API, and pass its configuration as Args in JSON.Functions for FirewallThe outcomes a firewall function returns, and the request and response headers it adds.Rules Engine for FirewallEvery criteria variable, comparison operator, and behavior a firewall rule accepts.Data StreamSend the same log output to an endpoint you own, for monitoring that outlives a test.Troubleshoot function execution and logsWhat to check when a function produces no log output or never runs.