Review/Validate APIM Inbound Policy for User-Agent Filtering (iOS/Android Restriction)

Hello Alhamzawi Hussein, Ali Mezher

Thanks for reaching out on Microsoft Q&A and really appreciate your patience while we looked into this.

Understand from description that you want to set up User-Agent filtering for your API endpoint to ensure it's only accessible from your iOS and Android applications.

Steps:

1. Extract and Normalize the User-Agent Header: Use the set-variable policy to extract the User-Agent header and convert it to lowercase for case-insensitive comparison.

      <set-variable name="userAgent" value="@(context.Request.Headers.GetValueOrDefault("User-Agent", "").ToLowerInvariant())" />
   

   Set variable policy
2. Conditionally Allow or Reject Requests: Implement the choose policy to check if the User-Agent contains substrings indicative of iOS or Android devices.

      <choose>
      <when condition="@(context.Variables.GetValueOrDefault<string>("userAgent").Contains("iphone") 
                     || context.Variables.GetValueOrDefault<string>("userAgent").Contains("ipad") 
                     || context.Variables.GetValueOrDefault<string>("userAgent").Contains("android"))">
        <!-- Allow request -->
      </when>
      <otherwise>
        <return-response>
            <set-status code="403" reason="Forbidden" />
            <set-body>{"error": "Only iOS and Android devices are allowed"}</set-body>
            <set-header name="Content-Type" exists-action="override">
                <value>application/json</value>
            </set-header>
        </return-response>
      </otherwise>
   

   Choose policy.
3. Return a Custom Response for Unauthorized Requests: If the User-Agent doesn't match the allowed devices, use the return-response policy to send a 403 Forbidden response.
   Return response policy

https://free.blessedness.top/en-sg/azure/api-management/set-edit-policies?tabs=formHow to set or edit Azure API Management policies | Microsoft Learn

I hope this helps in resolving the issue, do let me know if you have any further questions on this.

Thanks