Struct RefererRestrictionPlugin 

pub struct RefererRestrictionPlugin {
    whitelist: HostMatcher,
    blacklist: HostMatcher,
    bypass_missing: bool,
    message: Template,
}

Restricts access based on the host of the Referer request header.

Exactly one of whitelist / blacklist is configured (APISIX oneOf parity). A missing or malformed Referer is rejected unless bypass_missing is set. Rejections produce a 403 JSON response.

Fields

whitelist: HostMatcher

Host patterns that may pass; non-empty means whitelist mode.

blacklist: HostMatcher

Host patterns that are rejected; non-empty means blacklist mode.

bypass_missing: bool

Pass requests whose Referer is missing or malformed (default false).

message: Template

Body message for rejections. Supports {{namespace.path}} references (no legacy $var interpolation — this field never supported it, so this sweep must not start).

Implementations

impl RefererRestrictionPlugin

pub fn from_config(config: &HashMap<String, Value>) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• whitelist (array of host patterns): only these Referer hosts pass.
• blacklist (array of host patterns): these Referer hosts are rejected. Exactly one of whitelist / blacklist must be non-empty (APISIX oneOf parity). Patterns are exact hosts (example.com) or leading-* wildcards (*.example.com, which matches any subdomain but not the bare apex).
• bypass_missing (bool, default false): pass requests whose Referer header is missing or not a parseable http(s) URL.
• message (string, default "Your referer host is not allowed"): rejection message, returned as {"message": ...}. Supports {{namespace.path}} references.

type: referer-restriction
config:
  whitelist: ["example.com", "*.example.org"]
  bypass_missing: true

fn reject(&self, ctx: Context) -> Result<PluginOutput, PluginExecutionError>

Builds the 403 rejection routed through the denied port.

Trait Implementations

impl Plugin for RefererRestrictionPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”). This is also the key its PortSpec is registered under in port_spec.

fn execute<'life0, 'async_trait>( &'life0 self, ctx: Context, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Executes the plugin logic against the request/response context.

fn reads_response_body(&self) -> bool

Whether this configured instance reads context.response.body.

fn cache_target(&self) -> Option<CacheTarget>

The cache backend this node writes to, if it is a proxy-cache half.