This directory contains the Java source code and pom.xml file required to compile a simple custom policy for Apigee. The policy does one simple thing: delays for a designated or a random amount of time.

1. Some people are concerned that an API that generates errors and always returns naturally, as quickly as possible, may be subject to remote timing attacks. This callout could alleviate that concern. You could introduce this callout into the proxy flow, perhaps in a fault rule, and that would cause the response time to be randomized, preventing a timnig attack.

2. In cases in which a caller is suspect, or has caused several consecutive errors, this callout could force a fixed delay, or a backoff delay, before retry.

This example is not an official Google product, nor is it part of an official Google product.

You do not need to build the source code in order to use the policy in Apigee Edge. All you need is the built JAR, and the appropriate configuration for the policy. If you want to build it, feel free. The instructions are at the bottom of this readme.

1. copy the jar file, available in target/apigee-custom-delay-20210412.jar , if you have built the jar, or in the repo if you have not, to your apiproxy/resources/java directory. You can do this offline, or using the graphical Proxy Editor in the Apigee Edge Admin Portal.

2. include an XML file for the Java callout policy in your apiproxy/resources/policies directory. It should look like this:

    <JavaCallout name='Java-Delay-1'>
        ...
      <ClassName>com.google.apigee.callouts.delay.DelayCallout</ClassName>
      <ResourceURL>java://apigee-custom-delay-20210412.jar</ResourceURL>
    </JavaCallout>

3. use the Edge UI, or a command-line tool like importAndDeploy.js or similar to import the proxy into an Edge organization, and then deploy the proxy . Eg,

   node ./importAndDeploy.js -v -o $ORG -e $ENV -d ./bundle
   

4. Use a client to generate and send http requests to the proxy you just deployed . Eg,

   curl -i "https://$ORG-$ENV.apigee.net/delay/t1"
   

There is one callout class, com.google.apigee.callouts.delay.DelayCallout.

The delay time in milliseconds for the policy is configured via a property in the XML. By default it is a random number between 850 and 1850 milliseconds.

The callout is compiled to sleep between 850 and 1850 milliseconds. It selects randomly.

<JavaCallout name='Java-Delay-1'>
  <ClassName>com.google.apigee.callouts.delay.DelayCallout</ClassName>
  <ResourceURL>java://apigee-custom-delay-20210412.jar</ResourceURL>
</JavaCallout>

<JavaCallout name='Java-Delay-1'>
  <Properties>
    <Property name='delay'>{request.queryparam.ms}</Property>
  </Properties>
  <ClassName>com.google.apigee.callouts.delay.DelayCallout</ClassName>
  <ResourceURL>java://apigee-custom-delay-20210412.jar</ResourceURL>
</JavaCallout>

With this configuration you can specify the minimum and maximum time, and the callout will select a random value between them, and delay that amount.

<JavaCallout name='Java-Delay-1'>
  <Properties>
    <!-- delay between 350 and 750 milliseconds -->
    <Property name='delay'>350,750</Property>
  </Properties>
  <ClassName>com.google.apigee.callouts.delay.DelayCallout</ClassName>
  <ResourceURL>java://apigee-custom-delay-20210412.jar</ResourceURL>
</JavaCallout>

<JavaCallout name='Java-Delay-1'>
  <Properties>
    <!-- delay exactly 4 seconds -->
    <Property name='delay'>4000</Property>
  </Properties>
  <ClassName>com.google.apigee.callouts.delay.DelayCallout</ClassName>
  <ResourceURL>java://apigee-custom-delay-20210412.jar</ResourceURL>
</JavaCallout>

<JavaCallout name='Java-Delay-1'>
  <Properties>
    <Property name='delay'>{delayTime}</Property>
  </Properties>
  <ClassName>com.google.apigee.callouts.delay.DelayCallout</ClassName>
  <ResourceURL>java://apigee-custom-delay-20210412.jar</ResourceURL>
</JavaCallout>

You can find an example proxy bundle that uses the policy, here in this repo.

You don't need to build this callout in order to use it. But you can build it if you like. Building from source requires Java 1.8, and Maven.

1. unpack (if you can read this, you've already done that).

2. Build the repo

   • Configure the build on your machine by loading the Apigee jars into your local cache:
   • Build the jar and also run all the tests.
   • Create ZIP archive for uploading to apiproxy.

./buildsetup.sh

• Apigee Edge expressions v1.0
• Apigee Edge message-flow v1.0

These jars must be available on the classpath for the compile to succeed. You do not need to worry about these jars if you are not building from source. The buildsetup.sh script will download the Apigee files for you automatically, and will insert them into your maven cache. The pom file will take care of the other Jars.

(none)

This callout is open-source software, and is not a supported part of Apigee Edge. If you need assistance, you can try inquiring on The Apigee Community Site. There is no service-level guarantee for responses to inquiries regarding this callout.

This material is Copyright 2019 Google LLC. and is licensed under the Apache 2.0 License. This includes the Java code as well as the API Proxy configuration.

• There are no tests.