appsec

Documentation

Index

• func MonitorParsedHTTPBody(ctx context.Context, body interface{})

Examples

• MonitorParsedHTTPBody

Functions

func MonitorParsedHTTPBody

func MonitorParsedHTTPBody(ctx context.Context, body interface{})

MonitorParsedHTTPBody runs the security monitoring rules on the given *parsed* HTTP request body. The given context must be the HTTP request context as returned by the Context() method of an HTTP request. Calls to this function are ignored if AppSec is disabled or the given context is incorrect. Note that passing the raw bytes of the HTTP request body is not expected and would result in inaccurate attack detection.

Example

Monitor HTTP request parsed body

package main

import (
	"encoding/json"
	"io"
	"net/http"

	"git.proto.group/protoobp/pobp-trace-go/appsec"

	httptrace "git.proto.group/protoobp/pobp-trace-go/contrib/net/http"
)

type parsedBodyType struct {
	Value string `json:"value"`
}

func customBodyParser(body io.ReadCloser) (*parsedBodyType, error) {
	var parsedBody parsedBodyType
	err := json.NewDecoder(body).Decode(&parsedBody)
	return &parsedBody, err
}

func main() {
	mux := httptrace.NewServeMux()
	mux.HandleFunc("/body", func(w http.ResponseWriter, r *http.Request) {
		// Use the SDK to monitor the request's parsed body
		body, err := customBodyParser(r.Body)
		if err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}
		appsec.MonitorParsedHTTPBody(r.Context(), body)
		w.Write([]byte("Body monitored using AppSec SDK\n"))
	})
	http.ListenAndServe(":8080", mux)
}