Dynmic IP Whitelisting

[ankitkrsingha]

Hi All,

I'm looking into IP whitelisting using KVM javascript instead of using the ACL policy, as I'm expecting a dynamic IP array from KVM and as ACL cannot work with an IP array I'm thinking to use JS to check the KVM IP against the X-forwarded-for IP

Please suggest how much feasible is this approach, would there be any issue with Message Processors handling IP..?
If so, what alternate solution can be employed here?

cc: @DChiesa 

[dchiesa1]

Please suggest how much feasible is this approach,

Very feasible.

No problem doing this. You'll need to take care parsing the X-F-F header, to select the "right" IP Address.

Within the JS policy you can simply throw an exception , in the case of a disallowed IP address. And then use a FaultRule to handle the exception in the proxy. There are prior examples of this, I think, posted here on community in the history. I suggest you search for some examples. (I haven't searched myself, I just have a vague memory that this topic has been covered in the past here on the Apigee community forum).