Parameter access control-API Gateway(API Gateway)-阿里云帮助中心

Features

The param-access-control plugin enforces access control based on request parameters and context conditions for request validation and access management.

Runtime properties

Plugin execution phase: Authentication phase.
Plugin execution priority: 310.

Configuration fields

Parameter	Data type	Required	Default value	Description
parameters	object	Required	-	Defines the parameters to use. Parameters can be extracted from request headers, query strings, or the URL path.
rules	array of rule	Required	-	Defines the evaluation rules and processing logic.

`parameters` field description

Parameter	Format	Description
Header	`Header:parameter_name`	Extracts a parameter from the request header.
Query	`Query:parameter_name`	Extracts a parameter from the query string.
Path	`Path:ordinal_number`	Extracts the nth segment from the URL path. The ordinal number starts from 1.
Path	`Path`	Extracts the full URL path.

`rules` field description

Parameter	Data type	Required	Default value	Description
name	string	Required	-	The name of the rule.
condition	string	Required	-	The evaluation condition expression.
ifTrue	string	Optional	-	The instruction to be executed when the condition is true. Valid values: ALLOW and DENY.
ifFalse	string	Optional	-	The instruction to be executed when the condition is false. Valid values: ALLOW and DENY.
statusCode	number	Optional	403	The HTTP status code returned when the request is denied.
responseHeaders	object	Optional	-	The response header returned when the request is denied.
responseBody	string	Optional	-	The response body returned when the request is denied.

Supported operators and functions

Operator/Function	Description	Example
==	Equals	`userType == 'admin'`
!=	Not equal to	`status != 'inactive'`
>	Greater than	`version > '2.0'`
>=	Greater than or equal to	`level >= '3'`
<	Less than	`priority < '5'`
<=	Less than or equal to	`quota <= '100'`
contains	Contains a substring	`path.contains('api')`
matches	Matches a regular expression	`url.matches('*.jpg')`
startsWith	Matches a prefix	`path.startsWith('/api')`
endsWith	Matches a suffix	`filename.endsWith('.jpg')`
&&	Logical AND	`userType == 'admin' && level >= '3'`
\|\|	Logical OR	`path.startsWith('/api') \\|\\| path.startsWith('/v2')`
!	Logical NOT	`!(status == 'inactive')`

Configuration examples

Rules are evaluated in order until an ALLOW or DENY instruction is reached. Each rule must specify at least one of the ifTrue or ifFalse fields. Set a clear status code and response message for DENY operations.

Access control based on user identity

parameters:
  userType: "Header:userType"
  userId: "Path:1"

rules:
  - name: admin-access
    condition: "userType == 'admin'"
    ifTrue: "ALLOW"
  - name: user-access
    condition: "userId == '123'"
    ifFalse: "DENY"
    statusCode: 403
    responseBody: "Access Denied"

This configuration allows requests that meet these conditions:

# An administrator accesses any path
curl http://example.com/any/path? -H "userType: admin"

# A user accesses their own resources
curl http://example.com/123/profile

The following request is denied:

# A user accesses the resources of another user
curl http://example.com/456/profile

Access control based on API version

parameters:
  apiVersion: "Header:Api-Version"
  path: "Path"

rules:
  - name: version-check
    condition: "path.contains('/v2/') && apiVersion < '2.0'"
    ifTrue: "DENY"
    statusCode: 400
    responseHeaders:
      Content-Type: application/json
    responseBody: '{"error": "Please upgrade to API version 2.0 or above"}'