zuplo 7.4.1 → 7.4.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/api-management/introduction.md +1 -1
- package/docs/articles/api-key-api.mdx +3 -3
- package/docs/articles/custom-ci-cd-azure.mdx +1 -1
- package/docs/articles/custom-ci-cd-bitbucket.mdx +2 -2
- package/docs/articles/custom-code-patterns.md +1 -1
- package/docs/articles/custom-domains.mdx +2 -2
- package/docs/articles/development-options.mdx +4 -4
- package/docs/articles/fastly-zuplo-host-setup.mdx +5 -5
- package/docs/articles/feature-flags.mdx +442 -0
- package/docs/articles/gke-with-upstream-auth-policy.mdx +7 -7
- package/docs/articles/health-checks.mdx +4 -4
- package/docs/articles/hosting-options.mdx +2 -2
- package/docs/articles/local-development-env-variables.mdx +1 -1
- package/docs/articles/metrics-plugins.mdx +1 -1
- package/docs/articles/migration-overview.md +1 -1
- package/docs/articles/monorepo-deployment.mdx +10 -10
- package/docs/articles/performance-testing.mdx +10 -9
- package/docs/articles/plugin-azure-blob.mdx +1 -1
- package/docs/articles/plugin-azure-event-hubs.mdx +2 -2
- package/docs/articles/policies.mdx +2 -2
- package/docs/articles/securing-backend-mtls.mdx +3 -3
- package/docs/articles/securing-the-gateway-with-client-mtls.mdx +3 -3
- package/docs/articles/securing-your-backend.mdx +1 -1
- package/docs/articles/security.mdx +1 -1
- package/docs/articles/terraform.mdx +2 -2
- package/docs/articles/testing.mdx +6 -6
- package/docs/articles/troubleshooting-slow-responses.mdx +5 -6
- package/docs/articles/troubleshooting.md +1 -1
- package/docs/articles/use-openapi-extension-data.mdx +4 -4
- package/docs/articles/waf-ddos-akamai.md +13 -13
- package/docs/articles/waf-ddos-aws-waf-shield.mdx +14 -14
- package/docs/articles/waf-ddos-fastly.mdx +14 -14
- package/docs/articles/waf-ddos.mdx +7 -7
- package/docs/cli/authentication.mdx +1 -1
- package/docs/cli/lint.mdx +103 -0
- package/docs/concepts/how-zuplo-works.mdx +5 -4
- package/docs/concepts/upstream-credentials.mdx +1 -1
- package/docs/dedicated/akamai/architecture.mdx +23 -24
- package/docs/dedicated/akamai/cdn.mdx +20 -20
- package/docs/dedicated/architecture.mdx +28 -27
- package/docs/dedicated/custom-domains.mdx +3 -4
- package/docs/dedicated/federated-gateways.mdx +1 -1
- package/docs/dedicated/networking.mdx +10 -10
- package/docs/dedicated/overview.mdx +3 -3
- package/docs/dedicated/source-control.mdx +6 -5
- package/docs/handlers/custom-handler.mdx +4 -4
- package/docs/handlers/mcp-server.mdx +1 -1
- package/docs/handlers/url-forward.mdx +1 -2
- package/docs/mcp-server/introduction.mdx +4 -4
- package/docs/policies/ai-gateway-dlp-inbound/doc.md +79 -45
- package/docs/policies/ai-gateway-dlp-inbound/schema.json +5679 -3359
- package/docs/programmable-api/environment.mdx +1 -1
- package/docs/programmable-api/jwt-service-plugin.mdx +1 -1
- package/docs/programmable-api/logger.mdx +1 -1
- package/docs/programmable-api/runtime-errors.mdx +1 -1
- package/docs/programmable-api/zuplo-context.mdx +3 -3
- package/docs/self-hosted/overview.md +3 -3
- package/package.json +5 -5
|
@@ -3,7 +3,7 @@ title: Migrate to Zuplo from Other API Gateways
|
|
|
3
3
|
sidebar_label: Migration Overview
|
|
4
4
|
---
|
|
5
5
|
|
|
6
|
-
Moving to Zuplo from another
|
|
6
|
+
Moving to Zuplo from another gateway is straightforward. Zuplo is
|
|
7
7
|
OpenAPI-native, so you can import your existing API definitions and start
|
|
8
8
|
configuring policies in minutes. This section provides migration guides for the
|
|
9
9
|
most common API gateways.
|
|
@@ -2,18 +2,18 @@
|
|
|
2
2
|
title: Deploying Zuplo from a Monorepo
|
|
3
3
|
sidebar_label: Monorepo Deployment
|
|
4
4
|
description:
|
|
5
|
-
"Deploy a Zuplo
|
|
6
|
-
|
|
5
|
+
"Deploy a Zuplo Gateway from a monorepo subdirectory using the Zuplo CLI and
|
|
6
|
+
GitHub Actions."
|
|
7
7
|
---
|
|
8
8
|
|
|
9
|
-
If your Zuplo
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
9
|
+
If your Zuplo Gateway lives inside a monorepo alongside other services, you can
|
|
10
|
+
deploy it using the [Zuplo CLI](../cli/overview.mdx) and your CI/CD provider.
|
|
11
|
+
Zuplo's [built-in GitHub integration](./source-control-setup-github.mdx)
|
|
12
|
+
connects each project to a dedicated repository and deploys automatically on
|
|
13
|
+
every push. Because it doesn't natively support projects located in a
|
|
14
|
+
subdirectory, you need to use the Zuplo CLI with a
|
|
15
|
+
[custom CI/CD pipeline](./custom-ci-cd.mdx) to deploy from the correct
|
|
16
|
+
directory.
|
|
17
17
|
|
|
18
18
|
This guide covers the project structure requirements, CI/CD configuration, local
|
|
19
19
|
development, and common troubleshooting steps for monorepo setups.
|
|
@@ -1,17 +1,18 @@
|
|
|
1
1
|
---
|
|
2
|
-
title: Performance Testing Your
|
|
2
|
+
title: Performance Testing Your Gateway
|
|
3
3
|
sidebar_label: Performance Testing
|
|
4
4
|
---
|
|
5
5
|
|
|
6
6
|
<!-- vale Vale.Spelling["Blazemeter","JMeter","wrk"] = NO -->
|
|
7
7
|
|
|
8
8
|
Performance testing is critical for understanding the real-world performance of
|
|
9
|
-
your API when using
|
|
10
|
-
and accurate performance tests that properly measure latency and
|
|
9
|
+
your API when using a unified gateway like Zuplo. This guide helps you create
|
|
10
|
+
fair and accurate performance tests that properly measure latency and
|
|
11
|
+
throughput.
|
|
11
12
|
|
|
12
13
|
## Creating Fair Comparison Tests
|
|
13
14
|
|
|
14
|
-
When evaluating
|
|
15
|
+
When evaluating gateway performance, it's essential to ensure your tests
|
|
15
16
|
accurately reflect real-world conditions and provide a fair comparison between
|
|
16
17
|
direct backend calls and calls through your gateway.
|
|
17
18
|
|
|
@@ -53,7 +54,7 @@ traffic experiences significantly higher jitter (variance), making response
|
|
|
53
54
|
times less predictable.
|
|
54
55
|
|
|
55
56
|
This artificial performance boost from testing within the same cloud provider
|
|
56
|
-
can make it appear that
|
|
57
|
+
can make it appear that a gateway adds substantially more latency than it
|
|
57
58
|
actually does in real-world scenarios where traffic crosses network boundaries.
|
|
58
59
|
|
|
59
60
|
### Ensure Test Equality
|
|
@@ -106,14 +107,14 @@ impact in your analysis.
|
|
|
106
107
|
|
|
107
108
|
## Understanding Gateway Latency
|
|
108
109
|
|
|
109
|
-
|
|
110
|
+
Gateways necessarily add some latency to process requests. For Zuplo:
|
|
110
111
|
|
|
111
112
|
- **Base latency:** Approximately 20-30ms with no policies
|
|
112
113
|
- **Per policy:** Most policies add 1-5ms each
|
|
113
114
|
- **Complex policies:** Authentication, rate limiting, or custom code can add
|
|
114
115
|
5-15ms
|
|
115
116
|
|
|
116
|
-
This latency is the trade-off for the benefits
|
|
117
|
+
This latency is the trade-off for the benefits a gateway provides:
|
|
117
118
|
|
|
118
119
|
- Centralized authentication and authorization
|
|
119
120
|
- Rate limiting and quota management
|
|
@@ -299,7 +300,7 @@ Managed Dedicated, Zuplo can be deployed directly to:
|
|
|
299
300
|
|
|
300
301
|
This deployment model provides:
|
|
301
302
|
|
|
302
|
-
- **Minimal latency:** Your
|
|
303
|
+
- **Minimal latency:** Your gateway runs in the same cloud network as your
|
|
303
304
|
backend
|
|
304
305
|
- **Predictable performance:** Consistent sub-10ms latency for intra-region
|
|
305
306
|
traffic
|
|
@@ -364,7 +365,7 @@ periods.
|
|
|
364
365
|
## Summary
|
|
365
366
|
|
|
366
367
|
Creating fair performance tests requires careful attention to test conditions,
|
|
367
|
-
understanding of network topology, and realistic expectations about
|
|
368
|
+
understanding of network topology, and realistic expectations about gateway
|
|
368
369
|
overhead. By following these guidelines, you'll get accurate measurements that
|
|
369
370
|
help you make informed decisions about your API architecture.
|
|
370
371
|
|
|
@@ -4,7 +4,7 @@ sidebar_label: Azure Blob
|
|
|
4
4
|
---
|
|
5
5
|
|
|
6
6
|
This plugin pushes request/response logs to Azure Blob Storage. This can be used
|
|
7
|
-
to save request data generated by your
|
|
7
|
+
to save request data generated by your Zuplo Gateway to use for monitoring,
|
|
8
8
|
analytics, auditing, or debugging purposes.
|
|
9
9
|
|
|
10
10
|
<EnterpriseFeature name="Custom logging" />
|
|
@@ -4,8 +4,8 @@ sidebar_label: Azure Event Hubs
|
|
|
4
4
|
---
|
|
5
5
|
|
|
6
6
|
This plugin pushes request/response logs to Azure Event Hubs. This can be used
|
|
7
|
-
to stream the request data generated by your
|
|
8
|
-
analytics, auditing, or debugging purposes.
|
|
7
|
+
to stream the request data generated by your Zuplo Gateway to use for
|
|
8
|
+
monitoring, analytics, auditing, or debugging purposes.
|
|
9
9
|
|
|
10
10
|
<EnterpriseFeature name="Custom logging" />
|
|
11
11
|
|
|
@@ -28,6 +28,6 @@ Explore the navigation to see all of the built-in policies.
|
|
|
28
28
|
## Custom Policies
|
|
29
29
|
|
|
30
30
|
The ability to write custom policies that run in-process of your Gateway is at
|
|
31
|
-
the core of what makes Zuplo
|
|
32
|
-
policies to handle virtually any task. To learn more about
|
|
31
|
+
the core of what makes Zuplo a programmable gateway for APIs, AI, and MCP. You
|
|
32
|
+
can write policies to handle virtually any task. To learn more about
|
|
33
33
|
[writing custom policies see the documentation](../policies/custom-code-inbound.mdx).
|
|
@@ -6,9 +6,9 @@ sidebar_label: Gateway to Origin
|
|
|
6
6
|
<EnterpriseFeature name="mTLS Client Certificates" />
|
|
7
7
|
|
|
8
8
|
Mutual TLS (mTLS) authentication establishes a trust relationship between your
|
|
9
|
-
Zuplo
|
|
10
|
-
|
|
11
|
-
|
|
9
|
+
Zuplo Gateway and your backend services using client certificates. With mTLS,
|
|
10
|
+
both the client (Zuplo Gateway) and the server (your backend) authenticate each
|
|
11
|
+
other, creating a "Zero Trust" security model.
|
|
12
12
|
|
|
13
13
|
This is particularly useful for enterprise customers who need to ensure that
|
|
14
14
|
both parties in a connection verify each other's identity before exchanging
|
|
@@ -17,9 +17,9 @@ Zuplo.
|
|
|
17
17
|
|
|
18
18
|
:::note
|
|
19
19
|
|
|
20
|
-
Client mTLS is enforced at the Zuplo **
|
|
21
|
-
|
|
22
|
-
|
|
20
|
+
Client mTLS is enforced at the Zuplo **gateway** only. It is not available on
|
|
21
|
+
the Zuplo developer portal — the portal cannot require client certificates from
|
|
22
|
+
visitors.
|
|
23
23
|
|
|
24
24
|
:::
|
|
25
25
|
|
|
@@ -6,7 +6,7 @@ When using a gateway, it's important to ensure that your backend API is only
|
|
|
6
6
|
receiving traffic via the gateway to be confident that your policies are being
|
|
7
7
|
correctly applied to all traffic.
|
|
8
8
|
|
|
9
|
-

|
|
10
10
|
|
|
11
11
|
That means securing the communication between Zuplo and your backend API
|
|
12
12
|
(origin). Several options do this, and the right one depends on where your
|
|
@@ -49,7 +49,7 @@ infrastructure remain secure.
|
|
|
49
49
|
instead are connected to Cloudflare using outbound secure tunnels.
|
|
50
50
|
- Each service that's exposed is protected by DDoS, Firewall, WAF, and other
|
|
51
51
|
security measures.
|
|
52
|
-
- Internal and external APIs are protected by Zuplo
|
|
52
|
+
- Internal and external APIs are protected by Zuplo Gateway.
|
|
53
53
|
- Internal services can only be connected to by Zuplo employees using an
|
|
54
54
|
identity and device policy-enforced proxy using secure tunnels.
|
|
55
55
|
- Interconnected Zuplo services utilize mTLS authentication or gateway
|
|
@@ -21,7 +21,7 @@ require you to:
|
|
|
21
21
|
- Use tools like Terraform to bridge the gap between code and infrastructure
|
|
22
22
|
- Handle complex state reconciliation and drift detection
|
|
23
23
|
|
|
24
|
-
Zuplo eliminates this complexity entirely. Every aspect of your
|
|
24
|
+
Zuplo eliminates this complexity entirely. Every aspect of your gateway
|
|
25
25
|
configuration is stored as human-readable code and configuration files in your
|
|
26
26
|
repository:
|
|
27
27
|
|
|
@@ -43,7 +43,7 @@ partial states, no drift, and no manual cleanup required.
|
|
|
43
43
|
|
|
44
44
|
This atomic deployment model means:
|
|
45
45
|
|
|
46
|
-
- **No half-deployed states**: Your
|
|
46
|
+
- **No half-deployed states**: Your gateway is always in a known, consistent
|
|
47
47
|
state
|
|
48
48
|
- **Simple rollbacks**: Just revert your Git commit and redeploy
|
|
49
49
|
- **No state management**: Git is your single source of truth
|
|
@@ -3,9 +3,9 @@ title: Testing Your API
|
|
|
3
3
|
sidebar_label: Testing
|
|
4
4
|
---
|
|
5
5
|
|
|
6
|
-
Zuplo provides multiple ways to test your
|
|
7
|
-
|
|
8
|
-
|
|
6
|
+
Zuplo provides multiple ways to test your gateway at every stage of development.
|
|
7
|
+
Whether you are iterating locally, reviewing a pull request in a preview
|
|
8
|
+
environment, or gating production deployments in CI/CD, the
|
|
9
9
|
[`zuplo test`](../cli/test.mdx) command and the `@zuplo/test` library give you a
|
|
10
10
|
consistent testing experience.
|
|
11
11
|
|
|
@@ -32,7 +32,7 @@ suite against it.
|
|
|
32
32
|
npx zuplo dev
|
|
33
33
|
```
|
|
34
34
|
|
|
35
|
-
The
|
|
35
|
+
The gateway starts on `http://localhost:9000` by default. You can change the
|
|
36
36
|
port with the `--port` flag. See the [`zuplo dev` reference](../cli/dev.mdx) for
|
|
37
37
|
all available options.
|
|
38
38
|
|
|
@@ -370,7 +370,7 @@ describe("Authentication", () => {
|
|
|
370
370
|
|
|
371
371
|
## Writing integration tests
|
|
372
372
|
|
|
373
|
-
Integration tests verify that your
|
|
373
|
+
Integration tests verify that your gateway behaves correctly end-to-end,
|
|
374
374
|
including routing, policies, and backend connectivity. Because `zuplo test` runs
|
|
375
375
|
against a live endpoint (local or deployed), every test is inherently an
|
|
376
376
|
integration test.
|
|
@@ -451,7 +451,7 @@ describe("Request validation", () => {
|
|
|
451
451
|
:::caution{title="Advanced"}
|
|
452
452
|
|
|
453
453
|
Custom testing can be complicated and is best used only to test your own logic
|
|
454
|
-
rather than trying to mock large portions of your
|
|
454
|
+
rather than trying to mock large portions of your gateway.
|
|
455
455
|
|
|
456
456
|
:::
|
|
457
457
|
|
|
@@ -11,9 +11,9 @@ systematic approach helps you identify the root cause quickly. This guide walks
|
|
|
11
11
|
you through diagnosing latency issues — whether the source is the gateway, your
|
|
12
12
|
backend, the network, or something else entirely.
|
|
13
13
|
|
|
14
|
-
## Understanding
|
|
14
|
+
## Understanding Gateway Latency
|
|
15
15
|
|
|
16
|
-
Every
|
|
16
|
+
Every gateway adds some processing overhead to requests. For Zuplo, this
|
|
17
17
|
overhead is minimal:
|
|
18
18
|
|
|
19
19
|
- **Base latency**: Approximately 20–30ms with no policies enabled
|
|
@@ -90,9 +90,8 @@ testing services to confirm whether the slowness is location-specific.
|
|
|
90
90
|
|
|
91
91
|
### Backend Response Time
|
|
92
92
|
|
|
93
|
-
The most common cause of slow responses through any
|
|
94
|
-
|
|
95
|
-
takes.
|
|
93
|
+
The most common cause of slow responses through any gateway is a slow backend.
|
|
94
|
+
The gateway adds its processing time _on top of_ whatever the backend takes.
|
|
96
95
|
|
|
97
96
|
**How to identify**: Compare direct backend response times with gateway response
|
|
98
97
|
times. If both are slow, the issue is the backend.
|
|
@@ -366,7 +365,7 @@ back-and-forth diagnostic questions.
|
|
|
366
365
|
|
|
367
366
|
- [OpenTelemetry](./opentelemetry.mdx) — Distributed tracing and logging for
|
|
368
367
|
detailed request lifecycle visibility
|
|
369
|
-
- [Performance Testing Your
|
|
368
|
+
- [Performance Testing Your Gateway](./performance-testing.mdx) — How to
|
|
370
369
|
benchmark and compare gateway performance accurately
|
|
371
370
|
- [Proactive Monitoring](./monitoring-your-gateway.mdx) — Setting up health
|
|
372
371
|
checks and monitoring for your gateway
|
|
@@ -4,7 +4,7 @@ sidebar_label: Troubleshooting
|
|
|
4
4
|
---
|
|
5
5
|
|
|
6
6
|
This guide covers common errors you may encounter when building, deploying, and
|
|
7
|
-
running your Zuplo
|
|
7
|
+
running your Zuplo Gateway, along with steps to diagnose and fix them.
|
|
8
8
|
|
|
9
9
|
## Build errors
|
|
10
10
|
|
|
@@ -3,7 +3,7 @@ title: Using the OpenAPI Extension Data in Code
|
|
|
3
3
|
sidebar_label: "OpenAPI Extension Data"
|
|
4
4
|
description:
|
|
5
5
|
Learn how to add custom vendor-specific extensions to OpenAPI files and access
|
|
6
|
-
that data in your Zuplo
|
|
6
|
+
that data in your Zuplo Gateway code.
|
|
7
7
|
tags:
|
|
8
8
|
- openapi
|
|
9
9
|
- custom-code
|
|
@@ -15,9 +15,9 @@ add custom configuration to the API definition. An example of this is the
|
|
|
15
15
|
intended for public use.
|
|
16
16
|
|
|
17
17
|
This same type of extensibility can be used to add custom data to the OpenAPI
|
|
18
|
-
file which can then be used inside of your Zuplo
|
|
19
|
-
|
|
20
|
-
|
|
18
|
+
file which can then be used inside of your Zuplo Gateway. This data can be used
|
|
19
|
+
to configure the behavior of the gateway, such as setting up rate limiting,
|
|
20
|
+
authentication, or other custom behavior.
|
|
21
21
|
|
|
22
22
|
In this article, we will show you how to use the OpenAPI extension data in your
|
|
23
23
|
code.
|
|
@@ -9,20 +9,20 @@ configured to run as a custom origin behind Akamai.
|
|
|
9
9
|
## Securing Zuplo from Direct Access
|
|
10
10
|
|
|
11
11
|
With any WAF product, you will want to ensure that network traffic can't bypass
|
|
12
|
-
your WAF and hit your
|
|
13
|
-
that your
|
|
12
|
+
your WAF and hit your Zuplo Gateway directly. Akamai offers several ways to
|
|
13
|
+
ensure that your gateway is only accessible through the WAF.
|
|
14
14
|
|
|
15
15
|
The information below is a summary of Akamai's own recommendations for securing
|
|
16
|
-
your backend - regardless of whether you are using Zuplo, another
|
|
17
|
-
|
|
16
|
+
your backend - regardless of whether you are using Zuplo, another gateway, or
|
|
17
|
+
Akamai origins. You can reference the
|
|
18
18
|
[Akamai documentation](https://techdocs.akamai.com/application-security/docs/origin-server-protection).
|
|
19
19
|
|
|
20
20
|
### IP Address Restrictions
|
|
21
21
|
|
|
22
22
|
Akamai maintains a list of IP addresses that you can use to restrict access to
|
|
23
|
-
your
|
|
24
|
-
|
|
25
|
-
sufficient to protect unauthorized traffic from hitting your
|
|
23
|
+
your Zuplo Gateway. This is a good way to ensure that only Akamai can access
|
|
24
|
+
your gateway. However, as Akamai is a multi-tenant service, this method isn't
|
|
25
|
+
sufficient to protect unauthorized traffic from hitting your gateway.
|
|
26
26
|
|
|
27
27
|
In Zuplo, you can use a
|
|
28
28
|
[custom code policy](../policies/custom-code-inbound.mdx) to limit traffic to
|
|
@@ -46,15 +46,15 @@ in Akamai Control Center.
|
|
|
46
46
|
```
|
|
47
47
|
|
|
48
48
|
With this policy in place, only Akamai traffic will be allowed to hit your Zuplo
|
|
49
|
-
|
|
49
|
+
Gateway.
|
|
50
50
|
|
|
51
51
|
### Custom Headers
|
|
52
52
|
|
|
53
53
|
Another way to ensure that traffic is coming from Akamai is to use custom
|
|
54
54
|
headers. Custom headers can be added to your Akamai configuration and then
|
|
55
|
-
checked by your
|
|
55
|
+
checked by your Zuplo Gateway. This provides an additional layer of security on
|
|
56
56
|
top of IP address restrictions and prevents any unauthorized traffic from
|
|
57
|
-
hitting your
|
|
57
|
+
hitting your gateway - regardless of the source.
|
|
58
58
|
|
|
59
59
|
In Akamai, you can configure custom headers using the Property Manager or the
|
|
60
60
|
Akamai API. Add a custom header with a secret value that only you and Akamai
|
|
@@ -95,7 +95,7 @@ export default async function policy(
|
|
|
95
95
|
```
|
|
96
96
|
|
|
97
97
|
With this policy in place, only requests that include the custom header with the
|
|
98
|
-
secret value will be allowed to hit your Zuplo
|
|
98
|
+
secret value will be allowed to hit your Zuplo Gateway.
|
|
99
99
|
|
|
100
100
|
## Additional Akamai Origin Security Options
|
|
101
101
|
|
|
@@ -148,5 +148,5 @@ Learn more:
|
|
|
148
148
|
[Modify Incoming Request Header](https://techdocs.akamai.com/property-mgr/docs/modify-incoming-req-header)
|
|
149
149
|
|
|
150
150
|
These security measures can be used individually or combined to create multiple
|
|
151
|
-
layers of protection for your Zuplo
|
|
152
|
-
|
|
151
|
+
layers of protection for your Zuplo Gateway when running behind Akamai App & API
|
|
152
|
+
Protector.
|
|
@@ -9,22 +9,22 @@ to run as a custom backend behind CloudFront.
|
|
|
9
9
|
## Securing Zuplo from Direct Access
|
|
10
10
|
|
|
11
11
|
With any WAF product, you will want to ensure that network traffic can't bypass
|
|
12
|
-
your WAF and hit your
|
|
13
|
-
to ensure that your
|
|
12
|
+
your WAF and hit your Zuplo Gateway directly. AWS WAF + Shield offer several
|
|
13
|
+
ways to ensure that your gateway is only accessible through the WAF.
|
|
14
14
|
|
|
15
15
|
The information below is a summary of Amazon's own recommendations for securing
|
|
16
|
-
your backend - regardless of whether you are using Zuplo, another
|
|
17
|
-
|
|
16
|
+
your backend - regardless of whether you are using Zuplo, another gateway, or
|
|
17
|
+
AWS origins. You can also reference
|
|
18
18
|
[the AWS documentation](https://docs.aws.amazon.com/whitepapers/latest/secure-content-delivery-amazon-cloudfront/custom-origin-with-cloudfront.html)
|
|
19
19
|
directly.
|
|
20
20
|
|
|
21
21
|
### IP Address Restrictions
|
|
22
22
|
|
|
23
23
|
Amazon maintains a list of CloudFront IP addresses (separate from other AWS
|
|
24
|
-
uses) that you can use to restrict access to your
|
|
25
|
-
way to ensure that only CloudFront can access your
|
|
24
|
+
uses) that you can use to restrict access to your Zuplo Gateway. This is a good
|
|
25
|
+
way to ensure that only CloudFront can access your gateway. However, as
|
|
26
26
|
CloudFront is available to any AWS customer, this method isn't sufficient to
|
|
27
|
-
protect unauthorized traffic from hitting your
|
|
27
|
+
protect unauthorized traffic from hitting your gateway.
|
|
28
28
|
|
|
29
29
|
In Zuplo, you can use a
|
|
30
30
|
[custom code policy](../policies/custom-code-inbound.mdx) to limit traffic to
|
|
@@ -48,15 +48,15 @@ configure the policy with the `CLOUDFRONT` ranges from the
|
|
|
48
48
|
```
|
|
49
49
|
|
|
50
50
|
With this policy in place, only CloudFront traffic will be allowed to hit your
|
|
51
|
-
Zuplo
|
|
51
|
+
Zuplo Gateway.
|
|
52
52
|
|
|
53
53
|
### Custom Headers
|
|
54
54
|
|
|
55
55
|
Another way to ensure that traffic is coming from CloudFront is to use custom
|
|
56
56
|
headers. Custom headers can be added to your CloudFront distribution and then
|
|
57
|
-
checked by your
|
|
57
|
+
checked by your Zuplo Gateway. This provides an additional layer of security on
|
|
58
58
|
top of IP address restrictions and prevents any unauthorized traffic from
|
|
59
|
-
hitting your
|
|
59
|
+
hitting your gateway - regardless of the source.
|
|
60
60
|
|
|
61
61
|
In Zuplo, you can use a small custom code policy to limit traffic to only those
|
|
62
62
|
requests that include the custom header and secret value.
|
|
@@ -93,12 +93,12 @@ export default async function policy(
|
|
|
93
93
|
```
|
|
94
94
|
|
|
95
95
|
With this policy in place, only requests that include the custom header with the
|
|
96
|
-
secret value will be allowed to hit your Zuplo
|
|
96
|
+
secret value will be allowed to hit your Zuplo Gateway.
|
|
97
97
|
|
|
98
98
|
### Identity Based Options
|
|
99
99
|
|
|
100
100
|
Unfortunately, AWS WAF + Shield don't offer identity-based options like IAM or
|
|
101
|
-
network based options for securing your
|
|
101
|
+
network based options for securing your Zuplo Gateway. This is true for
|
|
102
102
|
[both AWS](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/restrict-access-to-load-balancer.html)
|
|
103
|
-
and non-AWS
|
|
104
|
-
|
|
103
|
+
and non-AWS gateway products. If you require these options, you will need to use
|
|
104
|
+
a different WAF product in front of your Zuplo Gateway.
|
|
@@ -12,20 +12,20 @@ Refer to Zuplo's documentation on
|
|
|
12
12
|
## Securing Zuplo from Direct Access
|
|
13
13
|
|
|
14
14
|
With any WAF product, you will want to ensure that network traffic can't bypass
|
|
15
|
-
your WAF and hit your
|
|
16
|
-
that your
|
|
15
|
+
your WAF and hit your Zuplo Gateway directly. Fastly offers several ways to
|
|
16
|
+
ensure that your gateway is only accessible through the WAF.
|
|
17
17
|
|
|
18
18
|
The information below is a summary of Fastly's own recommendations for securing
|
|
19
|
-
your backend - regardless of whether you are using Zuplo, another
|
|
20
|
-
|
|
19
|
+
your backend - regardless of whether you are using Zuplo, another gateway, or
|
|
20
|
+
Fastly origins. You can reference the
|
|
21
21
|
[Fastly documentation](https://www.fastly.com/documentation/guides/integrations/non-fastly-services/developer-guide-backends/).
|
|
22
22
|
|
|
23
23
|
### IP Address Restrictions
|
|
24
24
|
|
|
25
25
|
Fastly maintains a list of IP addresses that you can use to restrict access to
|
|
26
|
-
your
|
|
27
|
-
|
|
28
|
-
sufficient to protect unauthorized traffic from hitting your
|
|
26
|
+
your Zuplo Gateway. This is a good way to ensure that only Fastly can access
|
|
27
|
+
your gateway. However, as Fastly is a multi-tenant service, this method isn't
|
|
28
|
+
sufficient to protect unauthorized traffic from hitting your gateway.
|
|
29
29
|
|
|
30
30
|
In Zuplo, you can use a
|
|
31
31
|
[custom code policy](../policies/custom-code-inbound.mdx) to limit traffic to
|
|
@@ -49,16 +49,16 @@ configure the policy with the address ranges from
|
|
|
49
49
|
```
|
|
50
50
|
|
|
51
51
|
With this policy in place, only Fastly traffic will be allowed to hit your Zuplo
|
|
52
|
-
|
|
52
|
+
Gateway.
|
|
53
53
|
|
|
54
54
|
### Signed Headers
|
|
55
55
|
|
|
56
56
|
Another way to ensure that traffic is coming from Fastly is to use signed
|
|
57
57
|
headers. Signed headers can be added using a
|
|
58
58
|
[VLC Snippet](https://docs.fastly.com/en/guides/about-vcl-snippets) and then
|
|
59
|
-
checked by your
|
|
59
|
+
checked by your Zuplo Gateway. This provides an additional layer of security on
|
|
60
60
|
top of IP address restrictions and prevents any unauthorized traffic from
|
|
61
|
-
hitting your
|
|
61
|
+
hitting your gateway - regardless of the source.
|
|
62
62
|
|
|
63
63
|
In Fastly, you will need to create a VCL snippet that adds a signed header as
|
|
64
64
|
shown below. This example uses the `shared_secret` value stored in an
|
|
@@ -179,16 +179,16 @@ export default async function (
|
|
|
179
179
|
```
|
|
180
180
|
|
|
181
181
|
With this policy in place, only requests that include a valid sign header will
|
|
182
|
-
be allowed to hit your Zuplo
|
|
182
|
+
be allowed to hit your Zuplo Gateway.
|
|
183
183
|
|
|
184
184
|
### JWT Header
|
|
185
185
|
|
|
186
186
|
Another way to ensure that traffic is coming from Fastly is to add a JWT header
|
|
187
187
|
to the outgoing request. JWT headers can be added using a
|
|
188
188
|
[VLC Snippet](https://docs.fastly.com/en/guides/about-vcl-snippets) and then
|
|
189
|
-
checked by your
|
|
189
|
+
checked by your Zuplo Gateway. This provides an additional layer of security on
|
|
190
190
|
top of IP address restrictions and prevents any unauthorized traffic from
|
|
191
|
-
hitting your
|
|
191
|
+
hitting your gateway - regardless of the source.
|
|
192
192
|
|
|
193
193
|
:::tip
|
|
194
194
|
|
|
@@ -247,7 +247,7 @@ To verify the JWT header in Zuplo, you can utilize the JWT Auth Inbound policy.
|
|
|
247
247
|
### mTLS Authentication
|
|
248
248
|
|
|
249
249
|
Fastly supports mTLS authentication for backend services. This is a good way to
|
|
250
|
-
ensure that only Fastly can access your
|
|
250
|
+
ensure that only Fastly can access your Zuplo Gateway. For documentation on
|
|
251
251
|
configuring Fastly with mTLS, see the
|
|
252
252
|
[Fastly documentation](https://docs.fastly.com/en/guides/working-with-hosts#advanced-tls-options).
|
|
253
253
|
To configure Zuplo to accept mTLS connections, see the
|
|
@@ -2,8 +2,8 @@
|
|
|
2
2
|
title: Zuplo + WAF/DDoS Services
|
|
3
3
|
---
|
|
4
4
|
|
|
5
|
-
Many customers using Zuplo (or any other
|
|
6
|
-
|
|
5
|
+
Many customers using Zuplo (or any other gateway) often choose to deploy WAF and
|
|
6
|
+
DDoS protection in front of their gateway. You can use any WAF - we have
|
|
7
7
|
customers today using Azure, AWS, Akamai, CloudFlare and many other options.
|
|
8
8
|
|
|
9
9
|
However, there are some things to consider depending on how you host Zuplo
|
|
@@ -56,7 +56,7 @@ Akamai's App & API Protector provides comprehensive WAF and DDoS protection with
|
|
|
56
56
|
a global edge network. Akamai offers advanced bot management, API security, and
|
|
57
57
|
DDoS mitigation that works well with Zuplo's edge-deployed architecture. With
|
|
58
58
|
over 4,000 edge locations worldwide, Akamai ensures minimal latency when
|
|
59
|
-
protecting your Zuplo
|
|
59
|
+
protecting your Zuplo Gateway.
|
|
60
60
|
|
|
61
61
|
Key features include:
|
|
62
62
|
|
|
@@ -74,14 +74,14 @@ your users, maintaining the low-latency benefits of Zuplo's edge deployment.
|
|
|
74
74
|
### Cloudflare WAF + DDoS
|
|
75
75
|
|
|
76
76
|
Cloudflare is the easiest solution for custom WAF + DDoS in front of your Zuplo
|
|
77
|
-
|
|
77
|
+
Gateway deployed as managed-edge. Because managed-edge is already terminated
|
|
78
78
|
with Cloudflare, the integration is seamless and requires virtually zero
|
|
79
79
|
configuration. Simply point your Cloudflare managed domain to Zuplo and you are
|
|
80
80
|
protected. You can fully customize your WAF, firewall, DDoS or any other
|
|
81
81
|
security configuration offered by Cloudflare. When a request comes into
|
|
82
82
|
Cloudflare, it will be routed first through your account's configuration, then
|
|
83
|
-
will be sent to your Zuplo
|
|
84
|
-
|
|
83
|
+
will be sent to your Zuplo Gateway. The same thing happens on the outbound as
|
|
84
|
+
well.
|
|
85
85
|
|
|
86
86
|
A custom domain configured on Zuplo that utilizes Cloudflare DNS is completely
|
|
87
87
|
protected from requests bypassing your WAF and hitting Zuplo directly.
|
|
@@ -106,7 +106,7 @@ the two products together.
|
|
|
106
106
|
|
|
107
107
|
AWS offers DDoS (Shield) and WAF products that run at CloudFront edge locations.
|
|
108
108
|
This is another good option for edge-based WAF/DDoS protection in front of your
|
|
109
|
-
Zuplo
|
|
109
|
+
Zuplo Gateway. AWS CloudFront is also in hundreds of edge locations that are
|
|
110
110
|
very close to Cloudflare locations (again, this isn't something either company
|
|
111
111
|
discloses, but we suspect there is significant overlap in the physical locations
|
|
112
112
|
used by AWS and Cloudflare).
|