IP Address Restriction and CDN Cache Control Policies

Two new policies give you more control over who can call your API and how responses are cached: IP Address Restriction and CDN Cache Control.

Restrict routes by IP address

Limit a route to your office, VPN, or partner networks, or block specific addresses and subnets. IP Address Restriction supports allow lists and deny lists with individual IPv4 and IPv6 addresses or CIDR ranges.

Deny rules take precedence when an address matches both lists. Rejected requests receive a 403 Forbidden, and malformed entries are caught during deployment. You can apply different lists to different routes and use environment variables for each entry.

See the IP Address Restriction documentation for configuration examples.

Control CDN and browser caching independently

Set a longer cache lifetime at your CDN while keeping browser caches short. CDN Cache Control writes the appropriate response headers for Akamai, Fastly, Cloudflare, CloudFront, or a CDN that supports the generic CDN-Cache-Control header. CloudFront uses s-maxage in Cache-Control to set its separate CDN lifetime.

For Akamai, Fastly, and Cloudflare, you can also add cache tags to group responses for invalidation through your CDN’s purge API. The policy validates tags against each provider’s limits. A custom function can set cache lifetimes and tags per response.

By default, the policy respects upstream caching restrictions, including no-store, no-cache, private, and Set-Cookie responses. Your CDN must be configured to honor the headers the policy emits.

See the CDN Cache Control documentation for provider-specific setup and examples.

Getting started

In the Zuplo Portal, add IP Address Restriction to a route’s inbound policies or CDN Cache Control to its outbound policies, then configure and deploy.