Block HTTP Flood Attacks by Configuring Web CC Rules via API - Anti-DDoS - Alibaba Cloud - Anti-DDoS

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-ddoscoo:ConfigWebCCRuleV2

update

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
Domain	string	Yes	The domain name of the website service. Note The domain name must have a website service forwarding rule configured. You can call DescribeDomains to query all domain names.	www.example.com
RuleList	string	Yes	The configuration of the frequency control rule, expressed as a JSON-formatted string with the following structure: action: String type. Required. The matching action. Valid values: block: Block. challenge: JavaScript Challenge. watch: Monitor. name: String type. Required. The rule name. condition: Map type. Required. The matching condition. The structure is as follows: Note If multiple matching conditions are specified, the conditions are evaluated using the AND logic. field: String type. Required. The matching field. match_method: String type. Required. The matching method. Note For the valid values of field and match_method, see the supplementary description below the request parameters table. header_name: String type. Optional. The name of the custom HTTP header field. Note This parameter takes effect only when field is set to header. content: String type. Required. The matching content. ratelimit: String type. Required. The frequency control field. You can collect frequency statistics by IP address or custom header. The structure is as follows: interval: Integer type. Required. The statistical period (seconds). ttl: Integer type. Required. The action duration (seconds). threshold: Integer type. Required. The threshold (count). subkey: String type. Optional. The field name. Set this parameter only when the statistical source is header. target: String type. Required. The statistical source. Valid values: ip and header. status_code: String type. Optional. The frequency control field. You can collect statistics based on the count or ratio of status codes. The structure is as follows: enabled: Boolean type. Required. Specifies whether to enable status code statistics. code: Integer type. Required. Enabling status code. Valid values: 100 to 599. use_ratio: Boolean type. Required. Specifies whether to use the ratio. If set to true, the ratio is used. ratio_threshold: Integer type. Optional. The ratio at which enabling status code appears. When the ratio is used, the action is triggered only when the corresponding status code reaches ratio_threshold. Valid values: 1 to 100. count_threshold: Integer type. Optional. The count at which enabling status code appears. When the ratio is not used, the action is triggered only when the corresponding status code reaches count_threshold. Valid values: 2 to 50000. statistics: String type. Optional. The deduplication statistics. This parameter can be left empty, which indicates that deduplication is not performed. The structure is as follows: mode: String type. Required. Specifies whether to enable deduplication statistics. Valid values: count: deduplication disabled distinct: deduplication enabled field: String type. Required. The statistical source for deduplication. Valid values: ip, header, and uri. header_name: String type. Optional. The field name. Set this parameter only when the statistical source is header.	[{"action":"block","name":"trdsss","statistics":{"mode":"count","field":"header","header_name":"hahah"},"ratelimit":{"interval":60,"ttl":300,"threshold":70,"target":"ip"},"status_code":{"enabled":true,"code":404,"use_ratio":true,"ratio_threshold":80,"count_threshold":2},"condition":[{"field":"ip","match_method":"belong","content":"1.1.1.1"}]}]
Expires	integer	No	The validity period of the rule. Unit: seconds. Default value: 0, which indicates that the rule is permanently effective.	0

Valid values and mappings of field and match_method

Match field (field)	Description	Applicable logical operators (match_method)
ip	The source IP address of the request.	belong: belongs to nbelong: does not belong to ipinlist: in the list ipninlist: not in the list
uri	The URI of the request.	contain: contains ncontain: does not contain equal: equals nequal: does not equal lless: length less than lequal: length equals lgreat: length greater than prefix: prefix match inlist: equals one of multiple values ninlist: does not equal any of multiple values
referer	The source URL of the request, which indicates the page from which the request was redirected.	contain: contains ncontain: does not contain equal: equals nequal: does not equal lless: length less than lequal: length equals lgreat: length greater than nexist: does not exist inlist: equals one of multiple values ninlist: does not equal any of multiple values
user-agent	The browser-related information of the client that initiates the request, such as the identifier of the browser, rendering engine identity, and version information.	contain: contains ncontain: does not contain equal: equals nequal: does not equal lless: length less than lequal: length equals lgreat: length greater than inlist: equals one of multiple values ninlist: does not equal any of multiple values
params	Request parameter part of the request URL, which typically refers to the part after "?" in the URL. For example, `action=login` is request parameter part in `demo.aliyundoc.com/index.html?action=login`.	contain: contains ncontain: does not contain equal: equals nequal: does not equal lless: length less than lequal: length equals lgreat: length greater than inlist: equals one of multiple values ninlist: does not equal any of multiple values
cookie	The cookie information in the request.	contain: contains ncontain: does not contain equal: equals nequal: does not equal lless: length less than lequal: length equals lgreat: length greater than nexist: does not exist inlist: equals one of multiple values ninlist: does not equal any of multiple values
content-type	The HTTP content type (MIME type) specified in the request.	contain: contains ncontain: does not contain equal: equals nequal: does not equal lless: length less than lequal: length equals lgreat: length greater than inlist: equals one of multiple values ninlist: does not equal any of multiple values
x-forwarded-for	The real IP address of the client. X-Forwarded-For (XFF) is an HTTP request header field used to identify the original IP address of a client that connects through an HTTP proxy or load balancer. This field is included only in requests forwarded through an HTTP proxy or load balancer.	contain: contains ncontain: does not contain equal: equals nequal: does not equal lless: length less than lequal: length equals lgreat: length greater than nexist: does not exist inlist: equals one of multiple values ninlist: does not equal any of multiple values
content-length	The number of bytes contained in the request.	vless: value less than vequal: value equals vgreat: value greater than
post-body	The body content of the request.	contain: contains ncontain: does not contain equal: equals nequal: does not equal inlist: equals one of multiple values ninlist: does not equal any of multiple values
http-method	The method of the request, such as GET or POST.	equal: equals nequal: does not equal inlist: equals one of multiple values ninlist: does not equal any of multiple values
header	The header information of the request, used for custom HTTP header fields.	contain: contains ncontain: does not contain equal: equals nequal: does not equal lless: length less than lequal: length equals lgreat: length greater than nexist: does not exist inlist: equals one of multiple values ninlist: does not equal any of multiple values
scheme	The protocol of the request, such as HTTP or HTTPS.	equal: equals nequal: does not equal
protocol	The HTTP version of the request, such as HTTP/1.0, HTTP/1.1, or HTTP/2.0.	equal: equals nequal: does not equal inlist: equals one of multiple values ninlist: does not equal any of multiple values
http2-fingerprint	The HTTP 2.0 fingerprint of the request.	equal: equals nequal: does not equal inlist: equals one of multiple values ninlist: does not equal any of multiple values
ja3-fingerprint	The JA3 fingerprint of the request.	equal: equals nequal: does not equal inlist: equals one of multiple values ninlist: does not equal any of multiple values
ja4-fingerprint	The JA4 fingerprint of the request.	equal: equals nequal: does not equal inlist: equals one of multiple values ninlist: does not equal any of multiple values
area	The continent or country of the request.	areainlist: location blacklist selection
uri-path	The URI path of the request.	contain: contains ncontain: does not contain equal: equals nequal: does not equal lless: length less than lequal: length equals lgreat: length greater than prefix: prefix match inlist: equals one of multiple values ninlist: does not equal any of multiple values
cookie-name	The custom cookie.	contain: contains ncontain: does not contain equal: equals nequal: does not equal lless: length less than lequal: length equals lgreat: length greater than prefix: prefix match inlist: equals one of multiple values ninlist: does not equal any of multiple values
query-parameter	The custom query parameter.	contain: contains ncontain: does not contain equal: equals nequal: does not equal lless: length less than lequal: length equals lgreat: length greater than prefix: prefix match inlist: equals one of multiple values ninlist: does not equal any of multiple values
server-port	The server port of the request.	vless: value less than vequal: value equals vgreat: value greater than

Response elements

Element	Type	Description	Example
	object
RequestId	string	The ID of the request. Alibaba Cloud generates a unique identifier for each request. You can use the ID to troubleshoot issues.	0bcf28g5-d57c-11e7-9bs0-d89d6717dxbc

Examples

Success response

JSON format

{
  "RequestId": "0bcf28g5-d57c-11e7-9bs0-d89d6717dxbc"
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.