WSO2 - Throttle mediator implementation for the policy not blocking the requests from IP

Question

I have been struggling with WSO2 Throttle mediation and have setup using the WSO2 documentation. Still, I am unable to achieve the desired objective of getting the effect of the policy.

Although the code is there, but the policy says something like this:

• IF Request coming from IP={{MY_IP}} and request count <= 10
• THEN Do call the endpoint / sequence (AcceptSequence) -> In this, the endpoint will be called
• ELSE IF request count > 10, the requests will be logged in the database.

I have tested the endpoint for accept sequence AND the EI Dataservice for rejectSequence both individually and are working fine. I can even see the request coming in EI wso2carbon logs but there is no sign of throttle mediator calling and is returning "202 Accepted"

<?xml version="1.0" encoding="UTF-8"?>
<api context="/my_api" name="MY_API" version="1.0.0" version-type="context" xmlns="http://ws.apache.org/ns/synapse">
    <resource methods="POST">
        <inSequence>
            <log level="custom">
                <property expression="json-eval($)" name="Incoming Payload"/>
            </log>
            <property description="Client_Name" expression="$trp:Client_Name" name="Client_Name" scope="default" type="STRING"/>
            <property description="Client_DOB" expression="$trp:Client_DOB" name="Client_DOB" scope="default" type="STRING"/>
            <property description="Client_ID_Type" expression="$trp:Client_ID_Type" name="Client_ID_Type" scope="default" type="STRING"/>
            <property description="Client_ID_No" expression="$trp:Client_ID_No" name="Client_ID_No" scope="default" type="STRING"/>
            <property description="Client_Gender" expression="$trp:Client_Gender" name="Client_Gender" scope="default" type="STRING"/>
            <property description="Client_Nationality" expression="$trp:Client_Nationality" name="Client_Nationality" scope="default" type="STRING"/>
            <property description="Source_System" expression="$trp:Source_System" name="Source_System" scope="default" type="STRING"/>
            <property description="Transaction_Type" expression="$trp:Transaction_Type" name="Transaction_Type" scope="default" type="STRING"/>
            <property description="Transaction_Ref_No" expression="$trp:Transaction_Ref_No" name="Transaction_Ref_No" scope="default" type="STRING"/>
            <property description="Transaction_Ref_No_2" expression="$trp:Transaction_Ref_No_2" name="Transaction_Ref_No_2" scope="default" type="STRING"/>
            <property description="Transaction_Date" expression="$trp:Transaction_Date" name="Transaction_Date" scope="default" type="STRING"/>
        </inSequence>
        <outSequence>
            <throttle id="myThrottle" onAccept="acceptSequence" onReject="rejectSequence">
                <policy>
                    <wsp:Policy wsu:id="WSO2MediatorThrottlingPolicy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
                        <throttle:MediatorThrottleAssertion xmlns:throttle="http://www.wso2.org/products/wso2commons/throttle">
                            <throttle:MaximumConcurrentAccess>0</throttle:MaximumConcurrentAccess>
                            <wsp:Policy>
                                <throttle:ID throttle:type="IP">{{Required_IP}}</throttle:ID>
                                <wsp:Policy>
                                    <throttle:Control>
                                        <wsp:Policy>
                                            <throttle:MaximumCount>10</throttle:MaximumCount>
                                            <throttle:UnitTime>60000</throttle:UnitTime>
                                            <throttle:ProhibitTimePeriod>60000</throttle:ProhibitTimePeriod>
                                        </wsp:Policy>
                                    </throttle:Control>
                                </wsp:Policy>
                            </wsp:Policy>
                        </throttle:MediatorThrottleAssertion>
                    </wsp:Policy>
                </policy>
            </throttle>
            <log/>
        </outSequence>
        <faultSequence/>
    </resource>
</api>

Answer 1

The throttle mediator is not working as expected not because of an issue with the throttle mediator but due to the way that you have implemented this.

In the inSequence, you have only defined log and some property mediators. With this implementation, the outSequence will not be invoked. Since you have implemented the throttle mediator in the outSequence and since this is not executed you are able to invoke the API without the requests are getting throttled. You can refer to some of the documentation to clarify regarding EI message mediation (ex: [1])

The messages will be passed to the outSequnce from the inSequence only in the following two scenarios.

• If you have used loopback mediator [2]
• If you have used a send mediator to invoke a backend. In this case, the response from the backend is sent to the outSequence.

Therefore to resolve this issue you have 2 options.

• Add a loopback mediator at the end of the property mediators in the inSequence
• Modify the mediation as follows to get the throttle mediator to the inSequence.

<?xml version="1.0" encoding="UTF-8"?>
<api xmlns="http://ws.apache.org/ns/synapse" context="/my_api" name="MY_API" version="1.0.0" version-type="context">
   <resource methods="POST">
      <inSequence>
         <log level="custom">
            <property expression="json-eval($)" name="Incoming Payload" />
         </log>
         <property description="Client_Name" expression="$trp:Client_Name" name="Client_Name" scope="default" type="STRING" />
         <property description="Client_DOB" expression="$trp:Client_DOB" name="Client_DOB" scope="default" type="STRING" />
         <property description="Client_ID_Type" expression="$trp:Client_ID_Type" name="Client_ID_Type" scope="default" type="STRING" />
         <property description="Client_ID_No" expression="$trp:Client_ID_No" name="Client_ID_No" scope="default" type="STRING" />
         <property description="Client_Gender" expression="$trp:Client_Gender" name="Client_Gender" scope="default" type="STRING" />
         <property description="Client_Nationality" expression="$trp:Client_Nationality" name="Client_Nationality" scope="default" type="STRING" />
         <property description="Source_System" expression="$trp:Source_System" name="Source_System" scope="default" type="STRING" />
         <property description="Transaction_Type" expression="$trp:Transaction_Type" name="Transaction_Type" scope="default" type="STRING" />
         <property description="Transaction_Ref_No" expression="$trp:Transaction_Ref_No" name="Transaction_Ref_No" scope="default" type="STRING" />
         <property description="Transaction_Ref_No_2" expression="$trp:Transaction_Ref_No_2" name="Transaction_Ref_No_2" scope="default" type="STRING" />
         <property description="Transaction_Date" expression="$trp:Transaction_Date" name="Transaction_Date" scope="default" type="STRING" />
         <throttle id="myThrottle" onAccept="acceptSequence" onReject="rejectSequence">
            <policy>
               <wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:id="WSO2MediatorThrottlingPolicy">
                  <throttle:MediatorThrottleAssertion xmlns:throttle="http://www.wso2.org/products/wso2commons/throttle">
                     <throttle:MaximumConcurrentAccess>0</throttle:MaximumConcurrentAccess>
                     <wsp:Policy>
                        <throttle:ID throttle:type="IP">{{Required_IP}}</throttle:ID>
                        <wsp:Policy>
                           <throttle:Control>
                              <wsp:Policy>
                                 <throttle:MaximumCount>10</throttle:MaximumCount>
                                 <throttle:UnitTime>60000</throttle:UnitTime>
                                 <throttle:ProhibitTimePeriod>60000</throttle:ProhibitTimePeriod>
                              </wsp:Policy>
                           </throttle:Control>
                        </wsp:Policy>
                     </wsp:Policy>
                  </throttle:MediatorThrottleAssertion>
               </wsp:Policy>
            </policy>
         </throttle>
      </inSequence>
      <outSequence>
         <log />
         <send />
      </outSequence>
      <faultSequence />
   </resource>
</api>

[1]-https://docs.wso2.com/display/EI611/WSO2+Enterprise+Integrator+Best+Practices [2]-https://ei.docs.wso2.com/en/7.2.0/micro-integrator/references/mediators/loopback-Mediator/