Azion
This module intends to be used with Azion Functions.
This documentation describes both server-side and client-side integrations.
Prerequisites
- The server-side key available in your DataDome dashboard
- The client-side key available in your DataDome dashboard
- A running application on Azion
Installation
You can download the latest version of the module on this link.
Server-side configuration
The DataDome server-side part is using firewall functions.
Create a firewall function
- From the side menu, in the Edge Libraries section, click on Functions.
- Click on the + Functions button.
- Fill the information in the Main Settings tab:
- Name:
DataDome Firewall - Execution Environment:
Firewall - Status:
Active
- Name:
- In the Code tab, paste the content of the
firewall.jsscript. - Save your changes.
Create a firewall
-
From the side menu, in the Secure section, click on Firewalls.
-
Click on the + Firewall button.
-
Fill the informations in the Main Settings tab:
- Name:
DataDome - Add the following Modules:
- DDoS Protection Unmetered
- Function
- Status:
Active
- Name:
-
Click on Create.
-
In the Function Instances tab, click on the + Function button and fill the information:
- Name:
DataDome - Function: Select the
DataDome Firewallfunction you created. - Add your server-side settings to the Arguments section.
- Name:
-
In the Rules Engine tab, click on the + Rule button and fill the information:
- Name:
DataDome Rule - Criteria: Request Uri starts with
/ - Behaviors: Run Function and select the
DataDomefunction you just created.
- Name:
Your service is now protected!
Client-side configuration
The DataDome client-side part is injecting the JS Tag on HTML responses by using application functions.
Limitation on the size of the response body
Azion has no streaming HTML rewriter, so the module buffers the entire response body in memory before injecting the JS Tag.
To stay within the CPU and memory limits of Azion Functions, HTML responses larger than maximumResponseBodySize (2 MB by default) are passed through unmodified, without the JS Tag.
You can adjust this threshold in the Client-side settings.
Create an application function
- From the side menu, in the Edge Libraries section, click on Functions.
- Click on the + Functions button.
- Fill the information in the Main Settings tab:
- Name:
DataDome JS Tag Injection - Execution Environment:
Application - Status:
Active
- Name:
- In the Code tab, paste the content of the
js-tag-injection.jsscript. - Save your changes.
Update your application
Access the settings of the application you created.
- In the Main Settings tab, enable the Functions part in the Modules section.
- In the Functions Instances tab, click on the + Functions button and fill the information:
- Name:
DataDome JS Tag - Function: Select the
DataDome JS Tag Injectionfunction you created. - Provide your client-side settings in the Arguments section.
- Name:
- In the Rules Engine tab, click on the + Rule button and fill the information:
- Name:
DataDome Rule - Phase:
Request Phase - Criteria: Request Uri starts with
/ - Behaviors: Run Function and select the
DataDome JS Tagfunction you just created.
- Name:
The JS Tag is now injected on the HTML response sent by your origin.
Settings
Server-side settings
| Environment variable / argument | Description | Required | Default value | Example |
|---|---|---|---|---|
serverSideKey | Your DataDome server-side key, found in your dashboard. | Yes | - | - |
endpoint | URL of the Protection API. | No | https://api-azion.datadome.co/validate-request/ | - |
timeout | Request timeout to Protection API, in milliseconds. | No | 300 | 350 |
urlPatternExclusion | Regular expression to exclude URLs from being sent to the Protection API. | No | - | /admin/ |
urlPatternInclusion | Regular expression to only send certain URLs to the Protection API. | No | - | /login |
staticAssetExclusion | Regular expression (case-insensitive) to exclude static assets from being sent to the Protection API. | No | List of excluded static assets below | - |
encodedCharInclusion | Regular expression (case-insensitive) forcing the analysis of static assets with a path that contains encoded characters. Set an empty value to disable. | No | %23|%25|%2f|%3b|%3f | - |
removeMatrixParams | Remove matrix parameters (;param=value) from the path before matching the URL patterns. | No | true | false |
ipExclusion | List of IPs or CIDR for traffic that must not be sent to the Protection API. | No | - | ["192.168.0.1", "192.168.0.2", "192.168.0.0/24"] |
logEnrichedHeaders | Enable logs for Enriched headers. | No | false | true |
enableGraphQLSupport | Extract GraphQL operation name and type on requests to a GraphQL endpoint to improve protection. | No | false | true |
graphQLEndpoint | GraphQL endpoint on which the operation name and type should be extracted. You can specify multiple endpoints separated with commas. | No | graphql | - |
enableMCPSupport | Boolean to enable Model Context Protocol support. | No | false | true |
mcpEndpoint | MCP endpoint on which the information should be extracted. You can specify multiple endpoints separated with commas. | No | mcp | - |
maximumBodySize | Maximum size of the request body read for GraphQL and MCP extraction, in bytes. | No | 25600 (25 KB) | - |
enableDebugging | Log detailed information about the DataDome process. | No | false | true |
customFieldString1 | Static value or callback function to send a custom string. Refer to Add custom field section. | No | - | - |
customFieldString2 | Static value or callback function to send a custom string. Refer to Add custom field section. | No | - | - |
customFieldString3 | Static value or callback function to send a custom string. Refer to Add custom field section. | No | - | - |
customFieldInteger1 | Static value or callback function to send a custom integer. Refer to Add custom field section. | No | - | - |
customFieldInteger2 | Static value or callback function to send a custom integer. Refer to Add custom field section. | No | - | - |
customFieldFloat1 | Static value or callback function to send a custom float. Refer to Add custom field section. | No | - | - |
userID | Static value or callback function to send a custom value representing a user ID. Refer to Add custom field section. | No | - | - |
productID | Static value or callback function to send a custom value representing a product ID. Refer to Add custom field section. | No | - | - |
/\.(avi|avif|bmp|css|eot|flac|flv|gif|gz|ico|jpeg|jpg|js|json|less|map|mka|mkv|mov|mp3|mp4|mpeg|mpg|ogg|ogm|opus|otf|png|svg|svgz|swf|ttf|wav|webm|webp|woff|woff2|xml|zip)$/iClient-side settings
| Environment variable / argument | Description | Required | Default value | Example |
|---|---|---|---|---|
clientSideKey | Your DataDome client-side key, found in your dashboard. | Yes | - | - |
jsURL | URL of the DataDome JS Tag that can be changed to include the tag as a first party. | No | https://js.datadome.co/tags.js | https://ddfoo.com/tags.js |
jsTagOptions | JSON object describing DataDome JS Tag options. | No | {} | { "ajaxListenerPath": "example.com" } |
originURL | Scheme and host of your origin, used to fetch the HTML response. Set it to avoid the function fetching itself through your Azion domain (the loop is stopped with a 508 response). | No | - | https://origin.example.com |
maximumResponseBodySize | Maximum size of the response body to inject the JS Tag, in bytes. Larger responses are returned without the JS Tag. | No | 2097152 (2 MB) | - |
Updated about 8 hours ago

