Remote Access Control
Seamlessly manage access for all your pages and endpoints, including advanced methods for securing API endpoints, ensuring streamlined control and robust protection across your system.
Basic Access Control Information
Our system includes an advanced access control mechanism called Scoping. This feature allows you to assign specific scopes to users, functioning as digital keys to access certain pages and APIs. Scoping ensures secure and controlled entry management. For a detailed tutorial on assigning scopes to users, refer to Giving Users a Scope.
When a state page is created without any assigned scopes, it becomes accessible to all users by default. This configuration is referred to as the *public scope, providing unrestricted access to the page.
To easily determine whether a page is public or private, you can check the scope menu button's icon without opening the menu:
- Open Lock Icon: Indicates that the page is
publicand accessible to all users. - Closed Lock Icon: Indicates that the page is
privateand requires users to have the necessary scope for access.
The image below illustrates both scenarios for better understanding.
Scopes Management Modal
To manage scopes for a specific block, click on the lock icon associated with it. This will open the Scopes Management Modal, where you can perform the following actions:
- Select Additional Scopes: Choose existing scopes to grant users access to the block.
- Deselect Unnecessary Scopes: Remove scopes that are no longer required for access to that state page or API.
- Create a New Scope: If the required scope does not already exist, simply type the desired name into the search input. A green button will appear, allowing you to create the new scope instantly.
Default Scopes
When you create a new RUAL cluster, two default scopes are automatically generated:
| Scope name | Description |
|---|---|
*public |
This scope serves as the default for all state pages and APIs. If no other scopes are assigned to a state page or API, they will automatically use the *public scope, making them accessible to everyone. |
*loggedin |
This scope is optional and not selected by default. When applied, it restricts access to logged-in users only, ensuring that unauthenticated users cannot view the page. Instead, they will be redirected to the forbidden access page (/403). |
API-Specific Access Control
For API endpoints, in addition to the standard scoping system we have introduced two advanced access control options in RUAL core v13.0.7:
API Rate Limiting
This feature allows you to add a rate limit to an API in just a few seconds. The rate limit settings modal includes an enable switch and three configurable fields:
Type
Select the key type used for managing the rate limit. There are five options available:
- URL: Applies a rate limit to the entire API URL, covering all methods for all users.
- URL + User: Applies a rate limit to the entire API URL, covering all methods but specific to each user.
- Method + URL: Applies a rate limit to the combination of the API URL and the method, specific to each method but for all users.
- Method + URL + User: Applies a rate limit to the combination of the API URL, the method, and the user, specific to each method and user.
Max Requests in Timeframe
Set the maximum number of requests the key can make within a specified timeframe using this input field.
Timeframe in Seconds
Define the duration of the timeframe in seconds using this input. For example, if the timeframe is set to 30 seconds and the max requests are set to 10, the key can make up to 10 requests within 30 seconds. Any additional requests during that timeframe will be blocked.
API Throttle
This feature enables you to add a throttle to an API in just a few seconds, effectively functioning as a lock-and-wait system. The throttle settings modal includes an enable switch and two configurable fields:
Type
Select the key type used for managing the throttle. There are five options available:
- URL: Applies a throttle to the entire API URL, covering all methods for all users.
- URL + User: Applies a throttle to the entire API URL, covering all methods but specific to each user.
- Method + URL: Applies a throttle to the combination of the API URL and the method, specific to each method but for all users.
- Method + URL + User: Applies a throttle to the combination of the API URL, the method, and the user, specific to each method and user.
Timeout
Use this input to set the timeout duration for API requests. For instance, if the timeout is set to 10 seconds, the key will be allowed to make one request every 10 seconds.
