Content Type header check in policy fragment in Azure API Management

Vikhyath Shetty 25 Reputation points
2024-05-29T09:47:18.3766667+00:00

Hi,

I am trying to verify the content-type in the header of a request that downloads a file from an endpoint through the APIM.

The content-type is "multipart/form-data; boundary=<calculated when request is sent>" when checked in postman.

The policy fragment used to check the header is:

<check-header name="Content-Type" failed-check-httpcode="415" failed-check-error-message="Unsupported Media Type" ignore-case="true"> <value>application/json</value> <value>multipart/form-data</value> </check-header>

However this validation fails for file download request, but works fine for regular JSON requests.

What is the ideal policy code to check for this particular content type?

Azure API Management
Azure API Management
An Azure service that provides a hybrid, multi-cloud management platform for APIs.
1,902 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Fulvio Mercoliano 0 Reputation points Microsoft Employee
    2024-07-01T08:22:58.32+00:00

    The check-header policy runs an exact match on the whole header. When you have

    Content-Type: multipart/form-data; boundary=<calculated when request is sent>

    the header value doesn't match exactly with "multipart/form-data", then the request is rejected. You can keep the check-header policy to validate the application/json content-type, but for the multipart/form-data which contains a dynamic value (the boundary=xxx) you should move to a "manual" check.

    You can run the manual check extracting the Content-Type header, then applying a regex via a policy expression to detect if the header contains a valid value. Then based on the output of the regex, you can choose to block the request processing and return the 415 error.

    0 comments