Request Proxy
The Request proxy is a example approach to transform the Tessitura REST API into a secure and cacheable service layer.
What this approach is designed to do
- Securely control what Tessitura REST API endpoints can be exposed publicly
- Apply Cache headers to the Tessitura REST API endpoints to take advantage of CDN and browser based caching
- To be easily and quickly configurable
Overview
The idea of the Request proxy is to have a single endpoint that sits on a base path (https://example.v14.rest.api/SeatCurve/
), any request made that uses this base path will trigger the endpoint and run the following steps:
- The Request Proxy will remove the base path from the URI of the initial request for example
https://example.v14.rest.api/SeatCurve/Web/Session
turns into/Web/Session
, this now represents the TessituraREST URI
request we intend to make - The Request Proxy will check a API white list configuration file to determine if the REST API URI matches the white list file, if it doesn't a 403 forbidden synthetic response is returned
- The Request Proxy will make a request to the Tessitura REST API passing along the whole request including post data but with the new
REST URI
- The Request Proxy will check the API white list to obtain new cache header values, The Request proxy will then override the Tessitura REST response headers to include this new cache header
- The Request Proxy will then return the Tessitura REST API response with the new headers to the original requester
A example API white list configuration
At the core of the Request API is the API white list configuration file, this file outlines what Tessitura REST API calls are allowed and what cache headers to return for each request, below is a example of how this file could look:
{
"apiWhitelist": [
{
"path": "Web\/Session",
"method": "POST",
"headers": {
"Cache-Control": "private"
}
},
{
"path": "TXN\/Performances\/[0-9]*\/Seats[.a-z0-9=?&]*$",
"method": "GET",
"headers": {
"Cache-Control": "max-age=600,
stale-while-revalidate=604800, stale-if-error=1209600"
}
}
]
}
You will notice the path
variable is a regex string, this will allow support for calls with variables inside the path or query strings for example TXN/Performances/38745/Seats?modeOfSaleId=1
will match with the config path of TXN\/Performances\/[0-9]*\/Seats[.a-z0-9=?&]*$
git.