| flow | 0..* | |
| rules | 0..* | |
| accessLog | 0..1 | Writes exchange metrics into a Log4j appender |
| acmeHttpChallenge | 0..1 | See the documentation of the <acme /> element for usage details. |
| adminApi | 0..1 | Provides a JSON-based Admin API (health, apis, calls, exchange details, suggestions, ws) backed by the ExchangeStore. |
| adminConsole | 0..1 | Displays up-to-date statistics, recent exchanges and, by default, allows live modification of Membrane's configuration. |
| analyser | 0..1 | Analyses XML bodies and stores extracted root element + SOAP operation metadata in Exchange properties (request/response). |
| apiDocs | 0..1 | Publishes an overview of all OpenAPI-enabled proxies and serves Swagger UI under /api-docs/ui/*. |
| apiKey | 0..1 | Validates API keys extracted from incoming requests and looks up permissions (scopes) via configured key stores. Extractors can read the keys from HTTP headers, query parameters and may other message part. When validation succeeds, the interceptor adds an ApiKeySecurityScheme with the resolved scopes to the Exchange. Scopes can be checked in later plugins using the SpEL function hasScope("..."). On missing or invalid keys, a Problem Details response is generated (401 for missing, 403 for invalid) unless required="false" is set. |
| aPIsJSON | 0..1 | |
| authHead2Body | 0..1 | |
| balancer | 0..1 | Performs load-balancing between several nodes. Nodes sharing session state may be bundled into a cluster. May only be used as interceptor in a serviceProxy or api. |
| basicAuthentication | 0..1 | Blocks requests which do not have the correct RFC 1945 basic authentication credentials (HTTP header "Authentication: Basic ...."). |
| beautifier | 0..1 | Beautifies request and response bodies. Supported are the Formats: JSON, JSON5, XML, TEXT |
| cache | 0..1 | Don't use, this does NOT implement valid HTTP caching. |
| call | 0..1 | Calls an external endpoint |
| flow | 0..* | |
| choices | 0..* | |
| clamav | 0..1 | Delegates virus checks to an external Virus Scanner. |
| clusterNotification | 0..1 | Receives control messages to dynamically modify the configuration of a {@link LoadBalancingInterceptor}. |
| cors | 0..1 | Cross-Origin Resource Sharing (CORS) plugin that enables secure cross-origin HTTP requests. |
| counter | 0..1 | Returns a simple HTML page and counts how often it was requested (increments per request). |
| destination | 0..1 | Sets the destination URL for the exchange. This overrides any previous destination. |
| dispatching | 0..1 | This interceptor adds the destination specified in the target element to the list of destinations of the exchange object. It must be placed into the transport to make Service Proxies Work properly. It has to be placed after the ruleMatching interceptor. The ruleMatching interceptor looks up a service proxy for an incoming request and places it into the exchange object. The dispatching interceptor needs the service proxy to get information about the target. |
| echo | 0..1 | Returns the flow of plugins and copies the content of the request into a new response. The response has a status code of 200. Useful for testing. |
| exchangeStore | 0..1 | Adds the current state of HTTP requests and responses to an "exchange store". |
| flowInitiator | 0..1 | Initiates an OAuth2 login flow by redirecting to oauth2 (FlowContext). |
| for | 0..1 | Iterates over a collection extracted from the Exchange and applies its nested interceptors for each element. The current element is exposed in the exchange under the property key "it". |
| formValidation | 0..1 | Using the formValidation interceptor you can validate the input of HTML forms. |
| graphQLProtection | 0..1 | Check GraphQL-over-HTTP requests, enforcing several limits and/or restrictions. This effectively helps to reduce the attack surface. |
| greaser | 0..1 | Randomly applies greasing strategies to request/response messages (rate 0..1) to stress-test parsers (e.g., JSON/XML). |
| groovy | 0..1 | Executes a Groovy script. The script can access and manipulate data from the request and response. Use this or the Javascript plugin to extend the functions of Membrane by scripting. See: example/groovy for working samples |
| filterRules | 0..* | |
| http2xml | 0..1 | |
| httpClient | 0..1 | The httpClient sends the request of an exchange to a Web Server using the HTTP protocol. Usually it will be globally used inside the transport. However, it is also possible to use it inside a proxy to give the proxy an individual configuration for its outgoing HTTP connection that is different from the global configuration in the transport. |
| idempotency | 0..1 | Prevents duplicate request processing based on a dynamic idempotency key. |
| if | 0..1 | if allows conditional execution of nested interceptors. |
| index-interceptor | 0..1 | The index feature lists available proxys at a simple Web page. To use this feature just add a serviceProxy containing the index element. Of course you can protect the service proxy by using SSL or Username and Password. |
| interceptor | 0..1 | Wraps an interceptor provided as Spring bean (refid) or as nested interceptor (child element) and delegates all calls. |
| internalRouting | 0..1 | |
| javascript | 0..1 | Executes a Javascript. The script can access and manipulate data from the request and response. Use this or the Groovy plugin to extend the functions of Membrane by scripting. See the samples in examples/javascript. |
| json2Xml | 0..1 | Converts JSON message bodies into XML. The converter wraps the JSON document into a root element. The name of the root element is configurable. If unset, JSON objects default to "root" and JSON arrays default to "array". This interceptor reads the JSON body, converts it into XML and updates the message body and Content-Type header. The resulting XML is always UTF-8 encoded and starts with an XML prolog. |
| jsonProtection | 0..1 | Enforces restrictions on JSON request bodies to protect against JSON-based attacks and resource exhaustion. Validates against configurable limits to prevent attacks such as: |
| jwtAuth | 0..1 | Validates a JWT on requests (signature via JWKS, required exp/sub) and exposes claims in exchange properties ("jwt"). |
| jwtSign | 0..1 | |
| kubernetesValidation | 0..1 | Kubernetes Integration is still experimental. |
| limit | 0..1 | Limits the maximum length of a HTTP message body. |
| log | 0..1 | Logs request and response messages. The messages will appear either on the console or in a log file depending on the log configuration. |
| logContext | 0..1 | |
| login | 0..1 | The login interceptor can be used to restrict and secure end user access to an arbitrary web application. |
| ntlm | 0..1 | Performs NTLM authentication when the upstream responds with WWW-Authenticate: NTLM by replaying the request with NTLM headers. |
| oauth2authserver | 0..1 | OAuth2/OIDC authorization server endpoints (auth/token/userinfo/revocation/.well-known) with session + consent/login UI. |
| oauth2PermissionChecker | 0..1 | |
| oauth2Resource2 | 0..1 | Allows only authorized HTTP requests to pass through. Unauthorized requests get a redirect to the authorization server as response. This interceptor does Session Management and can thereby translate Session IDs to OAuth2/OIDC Access Tokens. Beyond regular OIDC-compliant authorization servers, this interceptor can also be used with Azure B2C. |
| openapiPublisher | 0..1 | The openapiPublisher serves OpenAPI documents |
| openapiValidator | 0..1 | Validator for OpenAPI documents |
| openTelemetry | 0..1 | Creates an OpenTelemetry span for each HTTP request passing through. Sends the tracing data to the speficied OpenTelemetry collector. See also examples/monitoring-tracing/opentelemetry for a demo, including screenshots. |
| paddingHeader | 0..1 | Adds an X-Padding header with random characters to pad message size (request/response). |
| prometheus | 0..1 | Exposes some of Membrane's internal metrics in the Prometheus format. See also examples/monitoring-tracing/prometheus for a demo, including a screenshot. |
| rateLimiter | 0..1 | The rateLimiter plugin limits the number of requests of a client in a period of time. As a default the client requests are grouped by client-Ip address and then counted. There are lots of possibilities to group the requests using the keyExpression. The requests can even be counted from different clients together. |
| regExReplacer | 0..1 | Runs a regular-expression-replacement on either the message body (default) or all header values. |
| replace | 0..1 | Replaces a JSON value at the configured JSONPath with a static string. |
| flow | 0..* | |
| requireAuth | 0..1 | |
| flow | 0..* | |
| rest2Soap | 0..1 | Converts REST requests into SOAP messages. |
| return | 0..1 | Terminates the exchange flow. The returned response is determined in the following order: |
| reverseProxying | 0..1 | Rewrites the scheme, hostname and port in the "Location" header in HTTP responses, as well as in the "Destination" header in HTTP requests. The rewriting reflects the different schemes, hostnames and ports used to access Membrane vs. the target HTTP server. |
| rewriter | 0..* | Rewrites or redirects the path of incoming requests based on a mapping. |
| ruleMatching | 0..1 | Selects and assigns the matching proxy rule for incoming requests; optionally adds/extends X-Forwarded-* headers. |
| sampleSoapService | 0..1 | |
| setBody | 0..1 | sets the content of the HTTP message body to the specified value. The value can be a static string, or it can be dynamically generated by an expression. Different languages such as SpEL, Groovy, XMLPath or JsonPath are supported. setBody does not support conditional processing or loops. When you need these features, resort to the template plugin instead. |
| setCookies | 0..* | Adds one or more Set-Cookie headers to the HTTP response for session handling, user preferences, or tracking purposes. Supports computing expiry, setting standard attributes like Domain and Path, and building a compliant cookie string. Useful for enriching responses with configurable cookies directly at gateway level without backend involvement. |
| setHeader | 0..1 | Set HTTP header on the current message. |
| setProperty | 0..1 | |
| shadowing | 0..1 | Clones incoming requests and sends them asynchronously to one or more shadow targets (main exchange continues unchanged). |
| shutdown | 0..1 | Shutdown interceptor. |
| soap2Rest | 0..1 | Converts SOAP messages into REST requests. |
| soapBody | 0..1 | Renders a SOAP body for legacy integration |
| soapOperationExtractor | 0..1 | |
| soapStackTraceFilter | 0..1 | The soapStackTraceFilter removes SOAP stack traces from message bodies. |
| static | 0..1 | Sets the message body to static content. The body is either provided inline as text content or loaded from a file/URL. If pretty is enabled, the formatted result is cached and reused until the interceptor is (re)initialized. |
| statisticsCSV | 0..1 | Writes statistics (time, status code, hostname, URI, etc.) about exchanges passing through into a CSV file (one line per exchange). |
| statisticsJDBC | 0..1 | Writes statistics (time, status code, hostname, URI, etc.) about exchanges passing through into a database (one row per exchange). |
| statisticsProvider | 0..1 | Serves request statistics as JSON from a JDBC-backed store. Supports paging (offset/max) and sorting (sort/order) via query parameters. |
| stompClient | 0..1 | |
| tcp | 0..1 | Allow HTTP protocol upgrades to the TCP protocol. After the upgrade, the connection's data packets are simply forwarded and not inspected. |
| template | 0..1 | Renders the body content of a message from a template. The template can produce plain text, Json or XML. Variables in the template are substituted with values from the body, header, query parameters, etc. If the extension of a referenced template file is .xml it will use XMLTemplateEngine otherwise StreamingTemplateEngine. Have a look at the samples in examples/templating. When the contentType is a JSON variant (e.g., application/json), the engine automatically escapes all inserted values. For example, in the JSON templating example, executing curl "localhost:2000/?answer=20" returns { "answer" : "20" }. The quotes surrounding the value 20 are added by the auto-escaping mechanism to ensure the output remains a valid string. This feature significantly mitigates security risks by preventing inadvertent JSON injection attacks. |
| throttle | 0..1 | The throttle feature can slow down traffic to thwart denial of service attacks. |
| time | 0..1 | Measures the end-to-end processing time of the child interceptor flow and logs an aligned summary. If an OpenTelemetry parent Span is present on the {@link Exchange}, a child sub-span is created around the measured section so timing data is exported to OTel as well. |
| tokenValidator | 0..1 | |
| transform | 0..1 | The transform feature applies an XSLT transformation to the content in the body of a message. After the transformation the body content is replaced with the result of the transformation. |
| userFeature | 0..1 | Handles features that are user-configured in proxies.xml . |
| validator | 0..1 | |
| webServer | 0..1 | Serves static files based on the request's path. |
| webServiceExplorer | 0..1 | Serves an HTML “web service explorer”. |
| webSocket | 0..1 | Allow HTTP protocol upgrades to the WebSocket protocol. After the upgrade, the connection's data packets are simply forwarded and not inspected. |
| wsaEndpointRewriter | 0..1 | |
| wsdlPublisher | 0..1 | The wsdlPublisher serves WSDL files (and attached XML Schema Documents), if your backend service does not already do so. |
| wsdlRewriter | 0..1 | The wsdlRewriter rewrites endpoint addresses of services and XML Schema locations in WSDL documents. |
| xenAuthentication | 0..1 | |
| xml2Json | 0..1 | Converts an XML message body to JSON. |
| xmlContentFilter | 0..1 | The xmlContentFilter removes certain XML elements from message bodies. The elements are described using an XPath expression. |
| xmlProtection | 0..1 | Prohibits XML documents to be passed through that look like XML attacks on older parsers. Too many attributes, too long element names are such indications. DTD definitions will simply be removed. |