0

I encountered some strange behavior while analyzing the http headers in the following treatment

| sftp folder | ==vfs=> | ESB processing | ===http===> REST endpoint

IN

Files are read from the folder with the following inbound endpoint:

<inboundEndpoint name="aaa2bbb-aaaFolder" onError="aaa2bbb-errors" protocol="file" sequence="aaa2bbb-processFiles" statistics="enable" suspend="false" trace="enable" xmlns="http://ws.apache.org/ns/synapse">
    <parameters>
        <parameter name="interval">5000</parameter>
        <parameter name="sequential">true</parameter>
        <parameter name="coordination">true</parameter>
        <parameter name="transport.vfs.ContentType">text/plain</parameter>
        <parameter name="transport.vfs.LockReleaseSameNode">false</parameter>
        <parameter name="transport.vfs.AutoLockRelease">false</parameter>
        <parameter name="transport.vfs.ActionAfterFailure">MOVE</parameter>
        <parameter name="transport.vfs.FailedRecordsFileName">vfs-move-failed-records.properties</parameter>
        <parameter name="transport.vfs.FailedRecordsFileDestination">repository/conf/</parameter>
        <parameter name="transport.vfs.MoveFailedRecordTimestampFormat">dd-MM-yyyy HH:mm:ss</parameter>
        <parameter name="transport.vfs.FailedRecordNextRetryDuration">3000</parameter>
        <parameter name="transport.vfs.ActionAfterProcess">MOVE</parameter>
        <parameter key="gov:/filesystem/fromAAA.txt" name="transport.vfs.FileURI"/>
        <parameter name="transport.vfs.ReplyFileURI">${registry:gov:/filesystem/fromAAA.txt}/success</parameter>
        <parameter name="transport.vfs.ReplyFileName">response.xml</parameter>
        <parameter name="transport.vfs.DistributedLock">false</parameter>
        <parameter name="transport.vfs.FileNamePattern">^CMDE.*\.zip|^(?!tmp).*\.xml</parameter>
        <parameter name="transport.vfs.Locking">disable</parameter>
        <parameter name="transport.vfs.FileSortAttribute">none</parameter>
        <parameter name="transport.vfs.FileSortAscending">true</parameter>
        <parameter name="transport.vfs.CreateFolder">true</parameter>
        <parameter name="transport.vfs.Streaming">false</parameter>
        <parameter name="transport.vfs.Build">false</parameter>
    </parameters>
</inboundEndpoint>

OUT

The problem is:

vfs variables such as File-Uri, File-Path or Last-Modified systematically end up in the Headers of the requests sent to the REST endpoint

Not only this isn't quite elegant but it raises a real security issue, for sftp File-Uri include username and passwords:

sftp://${user}:${password}@some_domain.com/somePath

Attempts

I tried several variable names to remove this specific header in my sequences:

  • fileURI
  • file-uri
  • File-Uri
  • FILE-URI
  • transport.vfs.fileURI
<header name="${some-name}" scope="transport" action="remove"/>

but those variables always end up in the headers. How should I fix it? Is it a matter of tuning the inbound-endpoint properly to encapsulate its transport variables from the ones of the call?

[environment]

  • wso2ei 6.5.0
  • fileconnector-2.0.20

1 Answer 1

0

Not sure if it helps, but I used the following to remove all transport headers.

<property name="TRANSPORT_HEADERS" action="remove" scope="axis2"/>

Or use the following to remove headers.

<property name="<name of the header to be removed>" scope="transport" action="remove"/>

Maybe its worth a try.

2
  • Thanks @Martin. Unfortunately, none of the options achieve what I am looking for. The first one removes everything, including necessary headers. The second has simply no effect. What a messy product
    – zar3bski
    Apr 29, 2020 at 15:02
  • That's really weird. Can you try with <property name="<name of the header to be removed>" scope="axis2" action="remove"/>. If this does not work maybe a workaround would be 1.) save the needed headers in properties 2.) remove all "TRANSPORT_HEADERS" 3.) set the needed headers with <header>. Not sure if one of this works. May 1, 2020 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.