Use the rules engine to create and deploy rules - Edge Security Acceleration

The rules engine allows you to follow the same syntax and logic to create and deploy various rules, such as cache rules, redirect rules, compression rules, origin rules, and Web Application Firewall (WAF) protection rules.

Overview

With the rules engine in Dynamic Content Delivery Network (CDN), you can create rules in a GUI. ESA checks whether to apply a specific configuration to incoming requests based on request parameters defined in the rules. This allows for more flexible and precise content distribution control.

Rule priorities

Rules on a specific aspect (such as browser cache TTL) take precedence over the global configuration for the aspect.
If a specific aspect (such as caching) has a list of rules, the rules apply from top to bottom in sequence. To change the priority of a specific rule in the rule list, change its order in the rule list.

Usage notes

A single rule condition cannot exceed 4 KB in size. The total size of all configuration information of a website, except security configuration, cannot exceed 512 KB in size.
A rule condition supports a nested structure with a maximum depth of two levels. Each level supports separate logical operation settings.
A single rule condition can contain up to 20 match fields.

Rule syntax

A rule condition consists of logical operators and expressions.

Logical operators

A logical operator connects expressions in a rule condition to perform a logical operation. The following logical operators are supported:

and: the logical conjunction operator. A rule condition is matched only if all expressions in the rule condition are true.
or: the logical disjunction operator. A rule condition is matched if one of the expressions in the rule condition is true.

Expressions

The simplest expression includes components described in the following table.

Component	Corresponding syntax parameter	Description	Required
Match field	Field	The match field.	Yes
Value	Value	The match value.	Yes
Comparison operator	Comparison_operator	The comparison operator.	Yes

Expression syntax

Simple expressions
- Syntax: <field><comparison_operator><value>
- Example: http.request.uri.path matches"/image\.(jpg|png)$"
Compound expressions
- Definition: multiple expressions connected by logical operators
- Syntax: <expreesion><logical_operator><expression>
- Example: host eq www.example.com and not http.request.uri.path eq "/content"

Match fields

Note

The hostname (http.host) match field applies to SSL/TLS encryption rules and supports only eq (equals) and ne (not equals) operators.

Match field	Variable name in expression	Supported comparison operator	Match value	Case-sensitive
Request method	http.request.method	eq ne in	Supported values: GET, POST, PURGE, PUT, HEAD, OPTIONS, DELETE, and PATCH	No
HTTP version	http.request.version		Supported values: HTTP/1.0, HTTP/1.1, HTTP/2.0, and HTTP/3.0	No
File name	http.request.uri.path.file_name		When you specify a file name in an expression, do not include the extension. For example: To specify the /a/b file, use the file name "b" in the expression. To specify the /a/b/ file, use an empty string in the expression. To specify the /foo.tar.bz2 file, use the file name "foo.tar" in the expression. To specify the 128_128.jpg file, use the file name "128_128" in the expression. Example values: "128_128", "240_240", "360_360", and "480_480"	Yes
File name extension	http.request.uri.path.extension		When you specify a file name extension, do not include the period (.). The extension is the string after the last period in the full name of a file. For example, "bz2" is the extension of the file foo.tar.bz2. Example values: "webp", "png", "gif", and "bz2"	Yes
Origin server	http.origin.address		The domain name or IP address of the origin server. Example values: example.com.cn and 1.1.1.1	No
Source IP address	ip.src		The IP address of the client. Example value: 1.1.1.1	No
Country/Region	ip.geoip.country		The 2-letter ISO 3166-1 Alpha-2 code of the country or region where the client IP address resides.	No
SSL/HTTPS	http.request.scheme	eq ne	Supported values: http and https	No
Hostname	http.host	eq ne contains starts_with ends_with matches in	Example values: "www1.alibaba.com" and "www2.alibaba.com"	No
URI	http.request.uri		Example value: /articles/index?section=330688&expand=comments	Yes
Full URI	http.request.full_uri		Example value: https://www.example.org/articles/index?section=330688&expand=comments	Yes
URI path	http.request.uri.path		Example value: /articles/index	Yes
URI query string	http.request.uri.query		The complete query string. Example value: section=330688&expand=comments	Yes
URI query string parameter	http.request.uri.args["session"]		You can specify a parameter name and a parameter value to match requests. For example, you can enter a parameter name session and a parameter value 330688.	Yes
Cookie	http.cookie	eq ne contains matches	The complete cookie content. Example value: session=330688;background=light	Yes
User Agent	http.user_agent		Example value: curl/7.29.0	Yes
Referer	http.referer		Example value: http://refer.com.cn	No
X-Forwarded-For	http.x_forwarded_for		Example value: 1.1.1.1 and 2.2.2.2	Yes
Header	http.request.headers["session"]		You can specify a header name and a header value to match requests. For example, you can enter a header name session and a header value 330688.	Yes
Cookie value	http.request.cookies["session"]		You can specify a cookie parameter and a cookie value to match requests. For example, you can enter a cookie parameter name session and a parameter value 330688.	Yes

Comparison operators

Operator name	Operator	Negatable	Value type	Remarks
Equals	eq	No	string
Not equals	ne	No	string
Contains	contains	Yes	string	The operator checks whether the specified string is contained.
Matches regex	matches	Yes	string	The operator checks for matches by regex. The operator is supported only in the Business and Enterprise plans.
Includes any	in	Yes	array	The expression is true if any of the specified elements is matched. The operator does not support wildcard characters in the value. The operator supports up to 32 elements in the value array.
Starts with	starts_with	Yes	string
Ends with	ends_with	Yes	string
Length less than	len-lt	No	integer	A match is found if the string length is less than the specified length condition.
Length equal to	len-eq	No	integer	A match is found if the string length is equal to the specified length condition.
Length greater than	len-gt	No	integer	A match is found if the string length is greater than the specified length condition.
In list	in_list	Yes	integer	This operator is used on global lists that you create at the account level.
Exists	exists	Yes	bool	The operator checks if the specified key exists in key-pair values. For example, you can use this operator in rules based on headers, cookies, and query strings.
Greater than	gt	No	integer	The operator applies to rules where the values are integers.
Smaller than	lt	No	integer	The operator applies to rules where the values are integers.
Greater than or equal to	ge	No	integer	The operator applies to rules where the values are integers.
Smaller than or equal to	le	No	integer	The operator applies to rules where the values are integers.

Wildcard characters

Wildcard character	Description
`?`	Matches one single character.
`*`	Matches any number of characters.

Create expressions

Note

By default, the expression builder is displayed for you to create expressions.

Use the expression builder

The expression builder allows you to quickly create expressions in an interactive way. However, you may need to switch to the expression editor when you create complicated expressions.

For example, if you want to create an expression based on the request method, select the expression components from the drop-down lists to have the expression builder to automatically create the expression.

Use the expression editor

The expression editor allows you to create more complicated expressions in a more flexible way.

Click Edit Expression.
In the editor, start writing your expressions.