dos.xml Reference

Python 2.7/3 |Java 8/11 |PHP 5/7 |Ruby |Go 1.11 / 1.12+ |Node.js

Warning: This feature is deprecated and replaced with the App Engine firewall. App Engine firewall provides more reliable protection as well as improved features. You can manage your firewall with the Cloud Console, gcloud command-line tool, and Admin API.

Important: This page provides a reference for the XML format of the DoS configuration file that is used by tooling based on the App Engine SDK for Java; for example the appcfg tool. If you are using Cloud SDK-based tooling, such as the gcloud command line, or Cloud SDK-based Maven, Gradle, Eclipse, or IntelliJ plugins, refer to the reference in YAML format.

The dos.xml file provides the controls to denylist IP addresses or subnets to protect your app from Denial of Service (DOS) attacks or similar forms of abuse. For more information, see Configuring DoS protection.

By default, App Engine serves a generic error page to denylisted addresses. You can configure your app to serve a custom response instead. For details, see the appengine-web.xml reference on static error handlers.

Example

The following is an example dos.xml file:

<?xml version="1.0" encoding="UTF-8"?>
<blacklistentries>
  <blacklist>
    <subnet>1.2.3.4</subnet>
    <description>a single IP address</description>
  </blacklist>
  <blacklist>
    <subnet>1.2.3.4/24</subnet>
    <description>an IPv4 subnet</description>
  </blacklist>
  <blacklist>
    <subnet>abcd::123:4567</subnet>
    <description>an IPv6 address</description>
  </blacklist>
  <blacklist>
    <subnet>abcd::123:4567/48</subnet>
    <description>an IPv6 subnet</description>
  </blacklist>
</blacklistentries>

Syntax

A dos.xml file in the WEB-INF directory of your application configures DoS Protection Service denylists for your application.

Element	Description
<description>	An optional description for the denylist entry.
<subnet>	Required. The subnet value is any valid IPv4 or IPv6 subnet in CIDR notation.

For an XSD describing the format, check the file docs/dos.xsd in the SDK.

Deploying the DoS configuration file

To deploy the dispatch configuration file without otherwise altering the currently serving version, use the command:

appcfg.sh update_dos <application directory>

replacing <application directory> with the path to your application main directory.

Deleting all DoS configuration

To delete all DoS configuration:

1. Edit the contents of the dos.xml file to:

   <?xml version="1.0" encoding="UTF-8"?>
   <blacklistentries/>
   

2. Deploy the dos.xml file to App Engine.

Limits

You can define a maximum of 100 denylist entries in your configuration file. Uploading a configuration file with more than 100 entries will fail.