Allow Anonymous Users Access
Scenario
In the previous exercise, you protected and rate limited your API for specific consumers. There are instances, where you want your API accessible for both authenticated and anonymous users.
In this exercise, you’ll expand on configurations - Protect and Rate Limit Your API. You’ll allow anonymous users access to the API at a higher rate limit than authenticated users
High Level Tasks
- Disable ACL if enabled from a previous execise
- Create Anonymous Consumer
- Add Anonymous Consumer to key-auth
- Verify Rate Limit
Disable ACL on the API (from the previous exercise)
$ http get localhost:8001/plugins
Note: ACL plugin ID ___________________
$ http patch :8001/apis/demo/plugins/<ACL_PLUGIN_ID> \
enabled=false
Replace
with your ACL plugin ID from previous step.
Create Anonymous Consumers
$ http post localhost:8001/consumers/ \
username=anonymous_users
Note: anonymous_users id ___________________
Get key-auth plugin ID
$ http get localhost:8001/plugins
Note: Key Auth Plugin ID _________________
Add Anonymous consumer to key-auth
Run patch command. Use the plugin_id and consumer_id from the previous steps.
$ http patch localhost:8001/apis/demo/plugins/0f1949c5-d961-4993-acfb-2185372735d3 config.anonymous=bfc09baf-d023-4fc0-bea0-f3ffe336f817
Note: Use post instead of patch command if you have not configured the key-auth plugin yet.
Configure Rate Limit (e.g. 3request/min)
Lets now rate limit
$ http post localhost:8001/apis/demo/plugins/ name=rate-limiting config.minute=3
Verify - Rate Limit for anonymous users
$ http get :8000 host:api.demo.com \
Summary
Congratulations! You modified you API that only allowed specific authenticated consumers access. Now anonymous users can access the API at no more than 3 request/min.
What’s Next
Lets become familiar with the KONG/NGINX configuration and log files. ####Explore NGINX-KONG Configuration Files