WSO2 API Manager 1.9-附加固定的标头信息

Question

I need to append a fixed Authorization header to an API endpoint. This is an application specific token for my endpoint system so I do not need API subscribers to enter this information nor want them in the know.

An almost similar question was raised before but hasn't been answered. The documentation here doesn't provide specific details and is a bit obscure so I am lost on how to achieve this. Has anybody done this?

Appreciate any help, cheers!

Answer 1

Do you want to set this as a custom HTTP header and send it to the backend? If yes, then you can use a property mediator to set this as a transport scope property just before the send mediator inside inSequence of your API, as shown below. Have a look at the property Fixed-Authorization set just before the send mediator.

<?xml version="1.0" encoding="UTF-8"?>
<api xmlns="http://ws.apache.org/ns/synapse"
     name="admin--Hello"
     context="/hello"
     version="1.0.0"
     version-type="url">
   <resource methods="POST GET OPTIONS DELETE PUT"
             url-mapping="/*"
             faultSequence="fault">
      <inSequence>
         <filter source="$ctx:AM_KEY_TYPE" regex="PRODUCTION">
            <then>
            <property name="Fixed-Authorization" value="yourAppToken" scope="transport"/>
               <send>
                  <endpoint name="admin--Hello_APIproductionEndpoint_0">
                     <http uri-template="http://echo.jsontest.com/key/value/one/two"/>
                  </endpoint>
               </send>
            </then>
            <else>
               <sequence key="_sandbox_key_error_"/>
            </else>
         </filter>
      </inSequence>
      <outSequence>
         <send/>
      </outSequence>
   </resource>
   <handlers>
      <handler class="org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler"/>
      <handler class="org.wso2.carbon.apimgt.gateway.handlers.throttling.APIThrottleHandler">
         <property name="id" value="A"/>
         <property name="policyKey" value="gov:/apimgt/applicationdata/tiers.xml"/>
      </handler>
      <handler class="org.wso2.carbon.apimgt.usage.publisher.APIMgtUsageHandler"/>
      <handler class="org.wso2.carbon.apimgt.usage.publisher.APIMgtGoogleAnalyticsTrackingHandler">
         <property name="configKey" value="gov:/apimgt/statistics/ga-config.xml"/>
      </handler>
      <handler class="org.wso2.carbon.apimgt.gateway.handlers.ext.APIManagerExtensionHandler"/>
   </handlers>
</api>

If you access the API, this property will be sent as a HTTP header to your backend endpoint. You can refer this post for more detailed explanation.

If you just want to pass this application token to the backend (but not as HTTP header), then you can pass it to the backend using JWT. Refer this document for more details.