Functions on a firewall

Deny, drop, modify, or answer a request from one firewall handler, using the event actions available to a function on a firewall.

Last updated

View as Markdown Agent setup

A general-purpose example for functions that run on the firewall, combining several request-handling actions in one handler. Use it as a starting point when you need to inspect incoming headers and metadata and then decide whether to block, drop, modify, or answer a request directly on Azion’s global network. The sample code exemplifies the following capabilities:

  • event.deny()
  • event.drop()
  • event.addRequestHeader()
  • event.addResponseHeader()
  • event.respondWith()
  • event.continue()
JavaScript
01 async function firewallHandler(event) {
02 // Access the value of x-deny, one of the headers
03 let condition = event.request.headers.get("x-deny");
04
05 if (condition) {
06 // event.deny() triggers a default 403 Response
07 event.deny();
08 }
09
10 let anotherCondition = event.request.headers.get("x-drop"); // Access the value of x-drop, , one of the headers
11 if (anotherCondition) {
12 // event.drop() drops the connection without returning a Response
13 event.drop();
14 }
15
16 // Access the value of x-third, one of the headers
17 let aThirdCondition = event.request.headers.get("x-third");
18 if (aThirdCondition) {
19 // event.addRequestHeader() adds a new header to the Request object, passing key:"value".
20 event.addRequestHeader("X-New-Request-Header", "Hello");
21 }
22
23 // Access the value of x-fourth, one of the headers
24 let aFourthCondition = event.request.headers.get("x-fourth");
25 if (aFourthCondition) {
26 // event.addResponseHeader() adds a new header to the Response object
27 // that will be delivered after accessing the origin.
28 event.addResponseHeader("X-New-Response-Header", "Bye");
29 }
30
31 // The metadata object contains the attributes of the request
32 if (event.request.metadata["remote_addr"] == "127.0.0.1") {
33 // event.respondWith(new Response()) allows you to serve your own Response
34 event.respondWith(new Response('{"my_custom_response": true}', {
35 status: 599,
36 headers: { "content-type": "application/json" }
37 }));
38 }
39
40 // If the request was not denied or dropped and did not have a Response returned,
41 // it is necessary to continue the processing, and to do so use use -> event.continue()
42 // Do not forget this command, otherwise the request won't continue!
43 event.continue();
44 }
45
46 addEventListener("firewall", (event) => event.waitUntil(firewallHandler(event)));

How it works

This code runs as a firewall handler, so it executes in a firewall and not in the application request path. It registers the handler with addEventListener("firewall", ...) and runs the asynchronous work inside event.waitUntil(). Refer to Functions for Firewall for the full set of actions a firewall handler can call.

The handler reads several request headers with event.request.headers.get() to drive its decisions. Depending on which header is present, it can call event.deny() to return a 403, event.drop() to close the connection without a response, or event.addRequestHeader() and event.addResponseHeader() to inject custom headers. It also inspects event.request.metadata["remote_addr"] and can short-circuit with event.respondWith(new Response(...)) to serve a custom JSON body. It ends with event.continue(), so any request not already handled proceeds normally.

JavaScript examples

Browse the other syntax patterns in the collection.

Functions for Firewall

Read the reference for every action a firewall handler can call.

Metadata API

Look up the request metadata fields, including remote_addr.

Functions Instances for Firewall

See how a function is instantiated on a firewall and triggered by a rule.

Limits for functions on a firewall

The limits a firewall function shares with every function, and where the bounds of the firewall itself are listed.