API token validation

Configure an API token rule

1. In the ESA console, choose Websites. In the Website column, click the target website.

2. In the left-side navigation pane, choose Security > API Security.

3. On the API Security page, click the API Rules tab, and then click Token Configuration.

4. Click Add to create a token configuration.

5. Configure the token parameters, and then click OK:

   • Configuration Name: Enter a custom name for the configuration, such as JWT-Demo.

   • Token Location: Select the location of the token in the request. You can select Header or Cookie and enter the corresponding key name.

     Note

     To check for tokens in multiple locations, click Or to create a logical OR condition. ESA can check up to four locations simultaneously.

   • Token Key: Add a token key by entering it manually or uploading a JSON file. For key requirements, see Token details.

     Note

     If you configure multiple keys, ESA uses the kid field to select a key for validation. The request passes validation if it matches any of the keys.

   

6. After configuring the token, return to the API Rules tab and click Add Rule to create an API rule.

7. Configure the following token validation parameters:

   • Rule Name: Enter a custom name for the rule, such as rule-jwt-demo.

   • Verify API: Click the drop-down list to select the hostname for token compliance verification. ESA will then automatically display the list of APIs under the selected hostname. Review and select the required APIs.

   • Select Token Configuration: Select one or more token configurations. If you select multiple configurations, choose one of the following options:

     • Validate at least one: The request must match at least one of the selected token configurations. Otherwise, the request is considered non-compliant.

     • Validate all: The request must match all of the selected token configurations. Otherwise, the request is considered non-compliant.

       Note

       By default, ESA considers requests without a token non-compliant. To allow requests that are missing a specific token, select Ignore from the drop-down list in the If No Token column for the corresponding token.

   • Action: Select an action for requests that fail token validation:

     • Monotor: Allows non-compliant requests and records a log. For more information, see Events.

     • Block: Blocks non-compliant requests and records a block log. For more information, see Events.

   

Verify the results

After creating an API rule, navigate to Security > Events. On the Events page, filter by the API Rule protection rule type. View detailed protection logs in the Sampling Logs section.

Token details

Token validation currently supports only JWT verification.

{
  "kty": "EC",
  "use": "sig",
  "crv": "P-256",
  "kid": "esa",
  "x": "QG3VFVwUX4IatQvBy7sqBvvmticCZ-eX5-nbtGKBOfI",
  "y": "A3PXCshn7XcG7Ivvd2K_DerW4LHAlIVKdqhrUnczTD0",
  "alg": "ES256"
}

FAQ

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ