This HTML5 document contains 32 embedded RDF statements represented using HTML+Microdata notation.

The embedded RDF content will be recognized by any processor of HTML5 Microdata.

Subject Item

n10:this

foaf:made

n4:VAL_HttpRestrictions

Subject Item

n2:this

sioc:creator_of

n4:VAL_HttpRestrictions

Subject Item

n14:item

n13:services_of

n4:VAL_HttpRestrictions

Subject Item

n5:this

sioc:creator_of

n4:VAL_HttpRestrictions

Subject Item

n6:VOS

sioc:container_of

n4:VAL_HttpRestrictions

atom:entry

n4:VAL_HttpRestrictions

atom:contains

n4:VAL_HttpRestrictions

Subject Item

n4:VAL_HttpRestrictions

rdf:type

sioct:Comment atom:Entry

dcterms:created

2017-06-13T05:40:56.344566

dcterms:modified

2017-06-29T07:34:59.146309

rdfs:label

VAL_HttpRestrictions

foaf:maker

n10:this n12:this

dc:title

VAL_HttpRestrictions

opl:isDescribedUsing

n17:rdf

sioc:has_creator

n5:this n2:this

sioc:content

%META:TOPICPARENT{name="ValQuickStartGuide"}% ---+ HTTP Restrictions %TOC% ---++ Virtuoso Restriction Hook Virtuoso provides a hook procedure called <nowiki>DB.DBA.DBEV_RESTRICTIONS</nowiki> which, given a map of restriction names to their requested value ("min" or "max"), will return a set of mappings from restriction name to a vector containing the restriction type ("min" or "max"), the restriction value, and the optional service ID which triggered the restriction. If the latter is null then the restriction was triggered by the client IP address. Since March 19th, 2014 Virtuoso provides a second restrictions hook <nowiki>DB.DBA.DBEV_GET_CONNECTION_RESTRICTION</nowiki> which supports restriction parameters. Restriction parameters simply allow to divide one restricted resource into several restrictions. This is very useful in terms of HTTP as it allows to define different restrictions for different urls or virtual dirs. This hook is implemented in VAL and uses the ACL restriction system by prefixing every restriction name with <code>urn:virtuoso:restrictions:</code>. VAL's implementation will always choose the least restrictive value. That means given two max values, one via the IP address and one via the authenticated user, VAL will choose the higher value. The Restrictions can be controlled via the [[http://docs.openlinksw.com/val/group__val__acl__module__http__api.html][VAL ACL RESTful API]] or the [[http://docs.openlinksw.com/val/group__val__acl__module__internal__api.html#ga89b2c77c10c82186ddc0e7b46093123c][Internal VAL API]]. Alternatively one can directly add the restrictions to the private graph matching the realm in which the restrictions should apply. Given the default realm <code><nowiki>http://www.openlinksw.com/ontology/acl#DefaultRealm</nowiki></code> and default hostname <code>"HOST"</code> the graph IRI would be <code><nowiki>http://HOST/acl/graph/restrictions/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm</nowiki></code> and the groups will be stored in named graph <code><nowiki>http://HOST/acl/graph/groups/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm</nowiki></code>. Be aware that [[http://docs.openlinksw.com/val/val_configuration.html#val_configuration_acl_graphs][these graphs can be customized]] for better readability. ---++ HTTP Restriction Names Virtuoso uses two restrictions which can be controlled on an IP address level or via service IDs. These restrictions define "global" limits on all virtual dirs. 1 <code>urn:virtuoso:restrictions:http-request-rate</code> restricts the maximum request rate per second. 1 <code>urn:virtuoso:restrictions:http-content-size</code> restricts the maximum content size for requests If one wants to define restrictions only for a specific virtual dir or a specific URL then the above URNs need to be used as restriction parameters in restrictions on the url in question. See below for examples. ---+++ HTTP Restriction Examples ---++++ Global Http Restrictions ---+++++ Restrict the requests per second to 10 for everyone for every http request <verbatim> SPARQL PREFIX oplres: <http://www.openlinksw.com/ontology/restrictions#> PREFIX foaf: <http://xmlns.com/foaf/0.1/> WITH GRAPH <http://{HOST-CNAME}/acl/restrictions/groups/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm> INSERT { <{REST-IRI}> a oplres:Restriction ; foaf:maker <{PERSON-WEBID}> ; foaf:name "Base line is 10 requests per second" ; oplres:hasMaxValue "10"^^xsd:decimal ; oplres:hasRestrictedResource <urn:virtuoso:restrictions:http-request-rate> ; oplres:hasAgentClass foaf:Agent ; oplres:hasRealm oplacl:DefaultRealm . }; </verbatim> ---+++++ Restrict the requests per second to 1000 for the intranet for every http request IP Address ranges are defined via conditional groups. Thus, we first define the conditional group which includes all IP addresses with a certain pattern: <verbatim> SPARQL PREFIX oplres: <http://www.openlinksw.com/ontology/restrictions#> PREFIX foaf: <http://xmlns.com/foaf/0.1/> WITH GRAPH <http://{HOST-CNAME}/acl/restrictions/groups/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm> INSERT { <{GROUP-IRI}> a oplacl:ConditionalGroup ; foaf:maker <{PERSON-WEBID}> ; foaf:name "Internal Network" ; oplacl:hasCondition [ a oplacl:IPAddressCondition ; oplacl:hasIPAddressPattern "198.168..*" ] . }; </verbatim> And then we use this group in our restriction: <verbatim> SPARQL PREFIX oplres: <http://www.openlinksw.com/ontology/restrictions#> PREFIX foaf: <http://xmlns.com/foaf/0.1/> WITH GRAPH <http://{HOST-CNAME}/acl/restrictions/groups/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm> INSERT { <{REST-IRI}> a oplres:Restriction ; foaf:maker <{PERSON-WEBID}> ; foaf:name "Intranet HTTP requests per second" ; oplres:hasMaxValue "1000"^^xsd:decimal ; oplres:hasRestrictedResource <urn:virtuoso:restrictions:http-request-rate> ; oplres:hasAgent <{GROUP-IRI}> ; oplres:hasRealm oplacl:DefaultRealm . }; </verbatim> ---++++ Virtual-Dir or URL-specific Http Restrictions ---+++++ Restrict the requests per second to 10 for everyone on one virtual dir The following restriction is scoped to all http requests on one virtual dir, i.e. /sparql. This means any request to pages in that virtual dir will be subject to the same restriction. This means that one client can make 10 requests in total on that virtual dir. <verbatim> SPARQL PREFIX oplres: <http://www.openlinksw.com/ontology/restrictions#> PREFIX foaf: <http://xmlns.com/foaf/0.1/> WITH GRAPH <http://{HOST-CNAME}/acl/restrictions/groups/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm> INSERT { <{REST-IRI}> a oplres:Restriction ; foaf:maker <{PERSON-WEBID}> ; foaf:name "Base line is 10 requests per second" ; oplres:hasMaxValue "10"^^xsd:decimal ; oplres:hasRestrictedResource <http://linkeddata.uriburner.com/sparql> ; oplres:hasRestrictedParameter <urn:virtuoso:restrictions:http-request-rate> ; oplres:hasAgentClass foaf:Agent ; oplres:hasRealm oplacl:DefaultRealm . }; </verbatim> ---+++++ Restrict the requests per second on one specific URL The following restriction allows 1000 requests per second on one specific URL (given that there is no virtual dir which matches that URL). It uses the same conditional group as above. So in practice this restriction limits the rate on one specific ODS API call: <verbatim> SPARQL PREFIX oplres: <http://www.openlinksw.com/ontology/restrictions#> PREFIX foaf: <http://xmlns.com/foaf/0.1/> WITH GRAPH <http://{HOST-CNAME}/acl/restrictions/groups/http%3A%2F%2Fwww.openlinksw.com%2Fontology%2Facl%23DefaultRealm> INSERT { <{REST-IRI}> a oplres:Restriction ; foaf:maker <{PERSON-WEBID}> ; foaf:name "Intranet HTTP requests per second" ; oplres:hasMaxValue "1000"^^xsd:decimal ; oplres:hasRestrictedResource <http://web.ods.openlinksw.com/ods/api/user.info> ; oplres:hasRestrictedParameter <urn:virtuoso:restrictions:http-request-rate> ; oplres:hasAgent <{GROUP-IRI}> ; oplres:hasRealm oplacl:DefaultRealm . }; </verbatim>

sioc:id

270a6aff46a414fb713484b1e4e43c10

sioc:link

n4:VAL_HttpRestrictions

sioc:has_container

n6:VOS

n13:has_services

n14:item

atom:title

VAL_HttpRestrictions

sioc:links_to

n19:ga89b2c77c10c82186ddc0e7b46093123c n20:val_configuration_acl_graphs n21:html

atom:source

n6:VOS

atom:author

n10:this

atom:published

2017-06-13T05:40:56Z

atom:updated

2017-06-29T07:34:59Z

sioc:topic

n6:VOS