Ignore case Request HTTP Query Parameters

Question

We wanted to be able to ignore case in our http parameter name for apikey--i.e., we want to accept ApiKey, APIKEY, and Apikey (and all other permutations) to be accepted...but it seems that request.queryparam.apikey will only accept "apikey" as HTTP parameter.

We thought of using ExtractVariable policy with ignoreCase attribute (then assign it to another variable qp.api_key) but it doesn't seem to work (or we don't fully understand what @ignoreCase does)..i.e., qp.api_key is only assigned if we pass apikey param (and not ApiKey, apiKey, etc).

<QueryParam name="apikey">
    <Pattern ignoreCase="true">{api_key}</Pattern>
    <VariablePrefix>qp</VariablePrefix>
</QueryParam>

how do we achieve case-insensitivity for the apikey HTTP get param?

Answer 1

I created a Python Script Policy:

import re

qs = flow.getVariable('request.querystring')
p = re.compile(r".*apikey=(\w+).*", re.IGNORECASE)
m = p.match(qs)
if m is not None:
  flow.setVariable('qp.api_key', m.group(1))

in this case, it gets assigned to qp.api_key and use that ref for the VerifyApiKey policy.

i think this should be a standard option to extract flow variables (i.e., case-insensitive param names) instead of going through extra policies to do the same relatively basic thing.

thanks for the quick response and ideas, guys.

Answer 2

The ignoreCase attribute applies to the Pattern - not the name.

Your pattern does not include anything other than the variable you are receiving, so in your case it does nothing.

But, a pattern can contain surrounding characters that comprise a pattern that you expect, as in:

<QueryParam name="apikey">
    <Pattern ignoreCase="true">abc{api_key}</Pattern>
    <VariablePrefix>qp</VariablePrefix>
</QueryParam>

In this case, when your API proxy is invoked with ?apikey=abc123 or ?apikey=aBc123, apikey will be set to 123.

Answer 3

If API Key is the only parameter in the querystring - following would work

<ExtractVariables async="false" continueOnError="false" enabled="true" name="extractapikey"> <DisplayName>ExtractApiKey</DisplayName> <Variable name="request.querystring"> <Pattern ignoreCase="true">apikey={api_key}</Pattern> </Variable> </ExtractVariables>

Answer 4

+1 for Randy's suggestion to choose the reasonable spellings of apikey and putting all of those in a single ExtractVariables policy:

apikey
APIkey
apiKey
ApiKey
APIKey
APIKEY

If you really wanted to handle all possible spellings, another solution would be to use a JavaScript callout. You can access the variable message.queryparam.names, which is a collection of all query parameter names, or message.querystring, which is the query string itself. Loop through the names or parse the query string and once you find a parameter name that is a case-insensitive match, grab the corresponding message.queryparam.{queryparam_name} variable. See the Apigee docs for the possible variables you can access.

Answer 5

I'd suggest lowercasing all parameters, so code can use a single standard naming convention. Code below can be executed within JavaScript policy to set variables that can be used later on in any subsequent policies. These variables will then become the variables to be referenced from any other places.

function setLowerCaseQueryParams(){
  var qpnames = request.queryParams;
  for(var key in qpnames){
      context.setVariable("queryparams." + key.toLowerCase(), request.queryParams[key]);
  }
}
setLowerCaseQueryParams();

With this function you can always send any combination of characters. e.g AbCdEFGHijKl=value, abcdEfghijkl=value or ABCDEFGHIJKL=value and it will always be accessed as:

var queryparamval = context.getVariable('queryparams.abcdefghijkl')