GS2-Guard API Reference

Provides a mechanism to protect the game from unauthorized access.

A BlockingPolicyModel can be configured per namespace in GS2-Guard, where the access control rules are described. By referencing the target GS2-Guard namespace from the namespace of each GS2 microservice, the blocking policy is applied to API requests to that microservice.

All decisions are made based on the source IP address and region of the request. Five detection conditions are available.

1. Restriction by country/region (locationDetection) List the target countries and regions in locations, and choose with locationRestriction whether to allow or deny access that matches.

2. Restriction by anonymous IP such as Tor or VPN (anonymousIpDetection)

3. Restriction by hosting provider IP (hostingProviderIpDetection)

4. Restriction by low-reputation IP (reputationIpDetection)

Conditions 2 through 4 only deny the matching access; there is no setting to allow it.

5. Restriction by IP address (ipAddressesDetection) List the target IP addresses in ipAddresses, and choose with ipAddressRestriction whether to allow or deny access that matches.

Each detection condition takes either “disabled” or “enabled”, and all of them are disabled by default. The corresponding restriction (Restriction) is applied only while the detection condition is enabled.

How access that matches none of the detection conditions is handled is determined by defaultRestriction, which defaults to “Allow”. By setting defaultRestriction to “Allow” and combining “Deny” in individual conditions, you can build a blacklist-style policy. Conversely, by setting defaultRestriction to “Deny” and allowing exceptions with locations or ipAddresses, you can build a whitelist-style policy. passServices lists the microservices that the blocking policy is not applied to, such as GS2-Account and GS2-Auth.

GS2-Guard is not a service used on its own; it takes effect only once it is referenced from the namespace of another microservice.