User Guide Cancel

Policies in ColdFusion API Manager

Last updated on

ColdFusion User Guide
Introduction to ColdFusion
Cloud Services in ColdFusion
Install ColdFusion
Use ColdFusion
Performance Monitoring Toolset
Adobe ColdFusion Builder extension for Visual Studio Code
Use ColdFusion Builder
Coldfusion API Manager
Configure and administer ColdFusion
ColdFusion functions
ColdFusion Tags
1. ColdFusion tags by category
2. Tags a-b
3. Tags c
  1. cfcache
  2. cfcalendar
  3. cfcase
  4. cfcatch
  5. cfchart
  6. cfchartdata
  7. cfchartseries
  8. cfclient
  9. cfclientsettings
  10. cfcol
  11. cfcollection
  12. cfcomponent
  13. cfcontent
  14. cfcontinue
  15. cfcookie
  16. Tags d-e
4. Tags f
5. Tags g-h
  1. cfgraph
  2. cfgraphdata
  3. cfgrid
  4. cfgridcolumn
  5. cfgridrow
  6. cfgridupdate
  7. cfheader
  8. cfhtmlhead
  9. cfhtmltopdf
  10. cfhtmltopdfitem
  11. cfhttp
  12. cfhttpparam
6. Tags i
  1. cfif
  2. cfimage
  3. cfimap
  4. cfimapfilter
  5. cfimpersonate
  6. cfimport
  7. cfinclude
  8. cfindex
  9. cfinput
  10. cfinsert
  11. cfinterface
  12. cfinvoke
  13. cfinvokeargument
7. Tags j-l
8. Tags m-o
9. Tags p-q
  1. cfparam
  2. cfpdf
  3. cfpdfform
  4. cfpdfformparam
  5. cfpdfparam
  6. cfpdfsubform
  7. cfpod
  8. cfpop
  9. cfpresentation
  10. cfpresentationslide
  11. cfpresenter
  12. cfprint
  13. cfprocessingdirective
  14. cfprocparam
  15. cfprocresult
  16. cfprogressbar
  17. cfproperty
  18. cfquery
  19. cfqueryparam
10. Tags r-s
  1. cfregistry
  2. cfreport
  3. cfreportparam
  4. cfrethrow
  5. cfreturn
  6. cfsavecontent
  7. cfschedule
  8. cfscript
  9. cfsearch
  10. cfselect
  11. cfservlet
  12. cfservletparam
  13. cfset
  14. cfsetting
  15. cfsharepoint
  16. cfsilent
  17. cfslider
  18. cfspreadsheet
  19. cfsprydataset
  20. cfstoredproc
  21. cfswitch
11. Tags t
  1. cftable
  2. cftextarea
  3. cftextinput
  4. cfthread
  5. cfthrow
  6. cftimer
  7. cftooltip
  8. cftrace
  9. cftransaction
  10. cftree
  11. cftreeitem
  12. cftry
12. Tags u-z
  1. cfupdate
  2. cfwddx
  3. cfwebsocket
  4. cfwindow
  5. cfxml
  6. cfzip
  7. cfzipparam
CFML Reference
1. Reserved words and variables
2. Ajax JavaScript functions
3. ColdFusion ActionScript functions
4. ColdFusion mobile functions
5. Application.cfc reference
6. Script functions implemented as CFCs
7. ColdFusion Flash Form style reference
8. ColdFusion event gateway reference
9. ColdFusion C++ CFX Reference
10. ColdFusion Java CFX reference
11. WDDX JavaScript Objects
Develop ColdFusion applications
1. Introducing ColdFusion
2. Changes in ColdFusion
3. Introduction to application development
4. The CFML programming language
5. Building blocks of ColdFusion applications
6. Develop CFML applications
7. Develop mobile applications
8. Access and use data
9. ColdFusion ORM
10. ColdFusion and HTML5
11. Flex and AIR integration in ColdFusion
12. Request and present information
13. Office file interoperability
14. ColdFusion portlets
15. Work with documents, charts, and reports
16. Use web elements and external objects
17. Use external resources

In ColdFusion API Manager, policies allow you to change the behavior of an API by making certain configuration changes. Policies are a collection of commands that are executed sequentially at the request or response of an API.

In API Manager, there are two main categories of policies:

Data transformation policies
Threat protection policies

Using the Data Transformation policies

REST APIs created with ColdFusion supports multiple representations of a resource. ColdFusion APIs support both XML and JSON representations for the request and response payloads.

But there are APIs that do not support multiple representations. For example, an API may only support an XML payload. But a web application might want the response in a JSON format. Or vice-versa. In such cases, ColdFusion API Manager converts the JSON payload to an XML payload.

In other words, the data transformation policies let you transform the request/response payload from JSON to XML or from XML to JSON.

As an API creator and publisher, you can enforce these policies to an API and convert the responses to the appropriate format before sending a response to the client.

JSON to XML Transformation

To convert a JSON response to XML:

Create a REST API that has a response in JSON format and publish the API.
Click Policies in the left navigation panel and choose JSON to XML Transformation policy. Click Add Policy.
Enter the values in the fields. For more information, refer to the field descriptions.
Create the policy.
Click My APIs in the left navigation panel and click Edit API on the newly created API to modify the API properties.
Click Policies in the left navigation panel and drag the policy into the Response section and click Save.
To test the API, click Test this API.

Choose the resource and click Run API Call. You can see the result in the Response Body section.

{
    "message": "Hello World",
    "names": [
        "John",
        "Paul",
        "George"
    ],
    "address": {
        "street": "Bleecker street",
        "housenumber": 50
    }
}

The XML transformation is as follows:

<beatles>
 <message>Hello World</message>
 <address>
  <street>Bleecker street</street>
  <housenumber>50</housenumber>
 </address>
 <names>John</names>
 <names>Paul</names>
 <names>George</names>
 <?xml-multiple names?>
</beatles>

XML to JSON Transformation

To convert an XML response to JSON:

Create a REST API that has a response in XML format and publish the API.
Click Policies in the left navigation panel and choose XML to JSON Transformation policy. Click Add Policy.
Enter the values in the fields. For more information, refer to the field descriptions.
Create the policy.
Click My APIs in the left navigation panel and click Edit API on the newly created API to modify the API properties.Step text
Click Policies in the left navigation panel and drag the policy into the Response section and click Save.
To test the API, click Test this API.

Choose the resources and click Run API Call. You can see the result in the Response Body section.

<?xml version="1.0" encoding="utf-8"?>
<IncomeAndHouseValue xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://ws.cdyne.com/DemographixWS">
  <PlaceInformation>
    <StateAbbrev>NY</StateAbbrev>
    <PlaceID>0036146</PlaceID>
    <Rural>false</Rural>
  </PlaceInformation>
  <Error>false</Error>
  <ErrorString>No Error</ErrorString>
  <MedianIncome>61544</MedianIncome>
  <MedianHouseValue>283600</MedianHouseValue>
</IncomeAndHouseValue>

The JSON transformation is as follows:

{
  "IncomeAndHouseValue": {
    "@xmlns": "http://ws.cdyne.com/DemographixWS",
    "@xmlns:xsd": "http://www.w3.org/2001/XMLSchema",
    "@xmlns:xsi": "http://www.w3.org/2001/XMLSchema-instance",
    "PlaceInformation": {
      "StateAbbrev": "NY",
      "PlaceID": 36146,
      "Rural": false
    },
    "Error": false,
    "ErrorString": "No Error",
    "MedianIncome": 61544,
    "MedianHouseValue": 283600
  }
}

Using the Threat Protection policies

In this example, you will apply a JSON Structure policy on an API and validate the response.

Like most APIs that support XML-based services, APIs that support JSON are vulnerable to content-level attacks. Simple JSON attacks attempt to use structures that overwhelm JSON parsers to crash a service and induce application-level denial-of-service attacks. The JSON Document Structure feature validates and enforces constraints on the structure of JSON documents. When the structure of an incoming JSON document exceeds a specified constraint, the API Gateway rejects the JSON document with error 500 and blocks further processing of the policy.

To enforce JSON structure policy:

Create a REST API that has JSON as response. Publish the API.
Edit the API and add a POST operation to a resource.
Add a parameter of type BODY to the resource.
Save your changes.
Go back to the main view, choose Policies->Threat Protection, and choose JSON Structure Limits.
Enter the values, as shown below. Set the maximum key length of a JSON object as 2.
Click Policies in the left navigation panel and drag the newly created policy in the Request section.
Save the changes. To test the API against the policy, click Test this API in the left navigation panel. Expand the resource with POST and pass the following JSON into the body.
```
{
    "names": [
        "John",
        "Paul",
        "George"
    ],
    "address": {
        "street": "Bleecker street",
        "housenumber": 50
    }
}
```
Click Run API Call. You can see the appropriate response.