{"id":28332909,"url":"https://github.com/dinochiesa/apigee-java-delay","last_synced_at":"2025-10-05T17:11:03.041Z","repository":{"id":147637052,"uuid":"190665330","full_name":"DinoChiesa/Apigee-Java-Delay","owner":"DinoChiesa","description":"An Apigee custom policy implemented in Java that introduces a delay in processing.","archived":false,"fork":false,"pushed_at":"2024-03-28T04:40:44.000Z","size":66,"stargazers_count":3,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-06-19T08:41:30.817Z","etag":null,"topics":["apigee","java","timing-attack"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/DinoChiesa.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2019-06-06T23:58:36.000Z","updated_at":"2022-11-07T16:17:30.000Z","dependencies_parsed_at":null,"dependency_job_id":"678c78ab-661c-43b1-9c27-4f0315b9f145","html_url":"https://github.com/DinoChiesa/Apigee-Java-Delay","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/DinoChiesa/Apigee-Java-Delay","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DinoChiesa%2FApigee-Java-Delay","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DinoChiesa%2FApigee-Java-Delay/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DinoChiesa%2FApigee-Java-Delay/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DinoChiesa%2FApigee-Java-Delay/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/DinoChiesa","download_url":"https://codeload.github.com/DinoChiesa/Apigee-Java-Delay/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DinoChiesa%2FApigee-Java-Delay/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278486308,"owners_count":25994945,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-05T02:00:06.059Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apigee","java","timing-attack"],"created_at":"2025-05-26T20:23:19.865Z","updated_at":"2025-10-05T17:11:03.034Z","avatar_url":"https://github.com/DinoChiesa.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Apigee Delay callout\n\nThis directory contains the Java source code and pom.xml file required to\ncompile a simple custom policy for Apigee. The policy does one simple thing:\ndelays for a designated or a random amount of time.\n\n## Why might this be useful?\n\n1. Some people are concerned that an API that generates errors and always\nreturns naturally, as quickly as possible, may be subject to [remote timing\nattacks](https://en.wikipedia.org/wiki/Timing_attack). This callout could\nalleviate that concern. You could introduce this callout into the proxy flow,\nperhaps in a fault rule, and that would cause the response time to be\nrandomized, preventing a timing attack.\n\n2. In cases in which a caller is suspect, or has caused several consecutive\nerrors, or is calling too often, this callout could force a fixed delay, or a\nbackoff delay, or a random delay, before Apigee sends the response.\n\nHow to determine if a caller is \"calling too much\" is up to you. You can use the\nQuota policy with a `continueOnError='true'` as one way to do that. Or a\n`CountOnly` element.\n\n\n## Disclaimer\n\nThis example is not an official Google product, nor is it part of an\nofficial Google product.\n\n## Using this policy in your API proxy\n\nYou do not need to build the source code in order to use the policy in Apigee.\nAll you need is the built JAR, and the appropriate configuration for the policy.\nIf you want to build it, feel free.  The instructions are at the bottom of this\nreadme.\n\n\n1. copy the jar file, available in target/apigee-custom-delay-20240327.jar , if\n   you have built the jar, or in [the\n   repo](bundle/apiproxy/resources/java/apigee-custom-delay-20240327.jar) if you\n   have not, to your apiproxy/resources/java directory. You can do this offline,\n   or using the graphical Proxy Editor in the Apigee Admin UI.\n\n2. include an XML file for the Java callout policy in your\n   apiproxy/resources/policies directory. It should look\n   like this:\n   ```xml\n    \u003cJavaCallout name='Java-Delay-1'\u003e\n        ...\n      \u003cClassName\u003ecom.google.apigee.callouts.delay.DelayCallout\u003c/ClassName\u003e\n      \u003cResourceURL\u003ejava://apigee-custom-delay-20240327.jar\u003c/ResourceURL\u003e\n    \u003c/JavaCallout\u003e\n   ```\n\n3. use the Apigee UI, or a command-line\n   tool like [apigeecli](https://github.com/apigee/apigeecli) or similar to\n   import the proxy into an Apigee organization, and then deploy the proxy.\n   Eg,\n   ```sh\n   ORG=my-org\n   ENV=my-environment\n   TOKEN=$(gcloud auth print-access-token)\n   apigeecli apis create bundle -f ./bundle/apiproxy --name my-proxy-name -o $ORG  --token $TOKEN\n   apigeecli apis deploy --wait --name my-proxy-name --ovr --org $ORG --env $ENV --token $TOKEN\n   ```\n\n\n4. Use a client to generate and send http requests to the proxy you just deployed . Eg,\n   ```\n   endpoint=https://my-custom-endpoint.net\n   curl -i \"$endpoint/delay/t1\"\n   ```\n\n\n## Notes on Usage\n\nThere is one callout class, com.google.apigee.callouts.delay.DelayCallout.\n\nThe delay time in milliseconds for the policy is configured via a property in\nthe XML.\n\n### Example: Delay a specific amount of time\n\nThis configuration is the simplest - it tells the callout to delay a specific\namount of time: 4 seconds.\n\n```xml\n\u003cJavaCallout name='Java-Delay-1'\u003e\n  \u003cProperties\u003e\n    \u003c!-- delay exactly 4000 milliseconds --\u003e\n    \u003cProperty name='delay'\u003e4000\u003c/Property\u003e\n  \u003c/Properties\u003e\n  \u003cClassName\u003ecom.google.apigee.callouts.delay.DelayCallout\u003c/ClassName\u003e\n  \u003cResourceURL\u003ejava://apigee-custom-delay-20240327.jar\u003c/ResourceURL\u003e\n\u003c/JavaCallout\u003e\n```\n\nThe largest delay the callout allows is 30 seconds. If\nyou specify an out of range value, the callout will delay a \"default\" amount of\ntime.\n\n### Example: Delay a random amount of time, given specific min and max\n\nWith this configuration you can specify the minimum and maximum time, and the\ncallout will select a random value between them, and delay that amount. It's non-deterministic.\n\n```xml\n\u003cJavaCallout name='Java-Delay-1'\u003e\n  \u003cProperties\u003e\n    \u003c!-- delay between 350 and 750 milliseconds --\u003e\n    \u003cProperty name='delay'\u003e350,750\u003c/Property\u003e\n  \u003c/Properties\u003e\n  \u003cClassName\u003ecom.google.apigee.callouts.delay.DelayCallout\u003c/ClassName\u003e\n  \u003cResourceURL\u003ejava://apigee-custom-delay-20240327.jar\u003c/ResourceURL\u003e\n\u003c/JavaCallout\u003e\n```\n\n\n### Example: Delay a time determined by a variable\n\nIn this case , the callout delays according to what is stored in a variable.\nThe content of the variable could be either an integer, or a pair of integers\nseparated by commas, for a min and max as described above.\n\n```xml\n\u003cJavaCallout name='Java-Delay-1'\u003e\n  \u003cProperties\u003e\n    \u003cProperty name='delay'\u003e{delayTime}\u003c/Property\u003e\n  \u003c/Properties\u003e\n  \u003cClassName\u003ecom.google.apigee.callouts.delay.DelayCallout\u003c/ClassName\u003e\n  \u003cResourceURL\u003ejava://apigee-custom-delay-20240327.jar\u003c/ResourceURL\u003e\n\u003c/JavaCallout\u003e\n```\n\n### Example: Delay a random amount of time, subject to the defaults\n\nWith no specified configuration, the callout is compiled to sleep between 850\nand 1850 milliseconds. It selects randomly.\n\n```xml\n\u003cJavaCallout name='Java-Delay-1'\u003e\n  \u003cClassName\u003ecom.google.apigee.callouts.delay.DelayCallout\u003c/ClassName\u003e\n  \u003cResourceURL\u003ejava://apigee-custom-delay-20240327.jar\u003c/ResourceURL\u003e\n\u003c/JavaCallout\u003e\n```\n\n### Further Notes\n\nThe callout does not help you to determine IF you want to delay a response.\nThere is no persistence or state managed by this callout. For that you would\nneed to combine it with a different policy, like the Quota policy that uses a\n`CountOnly` element.\n\nFor example:\n\n```\n\u003cStep\u003e\n  \u003cName\u003eQuota-CountOnly\u003c/Name\u003e\n\u003c/Step\u003e\n\u003cStep\u003e\n  \u003cName\u003eJava-Delay\u003c/Name\u003e\n  \u003cCondition\u003eratelimit.Quota-CountOnly.exceed.count \u003e 0\u003c/Condition\u003e\n\u003c/Step\u003e\n```\n\nThis would delay if and only if the Quota policy determined the caller had\nreached its soft limit. You could still have a separate \"hard limit\" Quota\npolicy that returned a 429.\n\n\n## Example API Proxy\n\nYou can find an example proxy bundle that uses the policy, [here in\nthis repo](bundle/apiproxy). It is a loopback proxy; it only executes the Java callout and returns.\n\nTo use it:\n\n1. import and deploy the example proxy with [apigeecli](https://github.com/apigee/apigeecli) or a similar tool.\n   Eg,\n   ```sh\n   ORG=my-org\n   ENV=my-environment\n   TOKEN=$(gcloud auth print-access-token)\n   apigeecli apis create bundle -f ./bundle/apiproxy --name delay -o $ORG  --token $TOKEN\n   apigeecli apis deploy --wait --name delay --ovr --org $ORG --env $ENV --token $TOKEN\n   ```\n\n2. Use a client to generate and send http requests to the proxy you just deployed . Eg,\n   ```\n   endpoint=https://my-custom-endpoint.net\n\n   # delay a fixed 1500ms for each response\n   curl -i \"$endpoint/delay/t1\"\n\n   # delay a random amount of time between 100 and 300 ms\n   curl -i \"$endpoint/delay/t2\"\n\n   # delay a random amount of time between 1000 and 3000 ms\n   curl -i \"$endpoint/delay/t3\"\n   ```\n\n\n## Building\n\nYou don't need to build this callout in order to use it.  But _you can build it\nif you like_. Building from source requires Java 1.8 (specifically), and Maven 3.5 or later.\n\n1. unpack (if you can read this, you've already done that).\n\n2. Before building _the first time_, configure the build on your machine by\n   loading the Apigee jars into your local cache:\n\n   ```\n   ./buildsetup.sh\n   ```\n\n3. Build with maven.\n   ```\n   mvn clean package\n   ```\n   This will build the jar and also run all the tests.\n\n\n\n## Build Dependencies\n\n- Apigee expressions v1.0\n- Apigee message-flow v1.0\n\nThese jars must be available on the classpath for the compile to\nsucceed. The [buildsetup.sh](./buildsetup.sh) script will download the\nApigee files for you automatically, and will insert them into your\nmaven cache.\n\nYou do not need to worry about these jars if you are not\nbuilding from source.\n\n## Runtime Dependencies\n\n(none)\n\n## Support\n\nThis callout is open-source software, and is not a supported part of Apigee.  If\nyou need assistance, you can try inquiring on [The Apigee Community\nSite](https://www.googlecloudcommunity.com/gc/Apigee/bd-p/cloud-apigee).  There\nis no service-level guarantee for responses to inquiries regarding this callout.\n\n## License\n\nThis material is Copyright 2019-2024 Google LLC.  and is licensed under the\n[Apache 2.0 License](LICENSE). This includes the Java code as well as the API\nProxy configuration.\n\n## Bugs\n\n* There are no tests.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdinochiesa%2Fapigee-java-delay","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdinochiesa%2Fapigee-java-delay","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdinochiesa%2Fapigee-java-delay/lists"}