[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThe JSONThreatProtection policy in Apigee and Apigee hybrid helps mitigate content-level attacks by allowing you to set limits on various JSON structures like arrays and strings.\u003c/p\u003e\n"],["\u003cp\u003eThis policy is an Extensible policy that may have cost or utilization implications depending on your Apigee license.\u003c/p\u003e\n"],["\u003cp\u003eThe policy's execution depends on the \u003ccode\u003eContent-Type\u003c/code\u003e being set to \u003ccode\u003eapplication/json\u003c/code\u003e in the request or response header.\u003c/p\u003e\n"],["\u003cp\u003eVarious attributes and elements, such as \u003ccode\u003eArrayElementCount\u003c/code\u003e, \u003ccode\u003eContainerDepth\u003c/code\u003e, \u003ccode\u003eObjectEntryCount\u003c/code\u003e, and \u003ccode\u003eStringValueLength\u003c/code\u003e, can be configured to define the constraints on JSON payloads.\u003c/p\u003e\n"],["\u003cp\u003eThe policy can trigger specific runtime errors like \u003ccode\u003eExecutionFailed\u003c/code\u003e, \u003ccode\u003eSourceUnavailable\u003c/code\u003e, or \u003ccode\u003eNonMessageVariable\u003c/code\u003e, which are used to set fault variables and can be handled with fault rules.\u003c/p\u003e\n"]]],[],null,["# JSONThreatProtection policy\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n### What\n\nMinimizes the risk posed by content-level attacks by enabling you to specify limits on various\nJSON structures, such as arrays and strings.\n\nThis policy is an *Extensible policy* and use of this policy might have cost or\nutilization implications, depending on your Apigee license. For information on policy types\nand usage implications, see\n[Policy types](/apigee/docs/api-platform/reference/policies/reference-overview-policy#policy-types).\n| **Note:** The following videos show the classic Proxy Editor in the\n| Apigee UI. Apigee is introducing a new version of the Proxy\n| Editor, which has a different design than the classic version shown in the videos.\n**Note:** This policy executes only if the `Content-Type` of the request or response header is set to `application/json.` \n**Video:** Watch a short video to learn more about how the\nJSONThreatProtection policy enables you to secure APIs against content-level attacks. \n**Video:** Check out this short video on the Apigee cross-cloud API platform. \n\nElement reference\n-----------------\n\nThe element reference describes the elements and attributes of the JSONThreatProtection\npolicy. \n\n```text\n\u003cJSONThreatProtection async=\"false\" continueOnError=\"false\" enabled=\"true\" name=\"JSON-Threat-Protection-1\"\u003e\n \u003cDisplayName\u003eJSONThreatProtection 1\u003c/DisplayName\u003e\n \u003cArrayElementCount\u003e20\u003c/ArrayElementCount\u003e\n \u003cContainerDepth\u003e10\u003c/ContainerDepth\u003e\n \u003cObjectEntryCount\u003e15\u003c/ObjectEntryCount\u003e\n \u003cObjectEntryNameLength\u003e50\u003c/ObjectEntryNameLength\u003e\n \u003cSource\u003erequest\u003c/Source\u003e\n \u003cStringValueLength\u003e500\u003c/StringValueLength\u003e\n\u003c/JSONThreatProtection\u003e\n```\n\n\\\u003cJSONThreatProtection\\\u003e attributes\n-----------------------------------\n\n```text\n\u003cJSONThreatProtection async=\"false\" continueOnError=\"false\" enabled=\"true\" name=\"JSON-Threat-Protection-1\"\u003e \n```\n\nThe following table describes attributes that are common to all policy parent elements:\n\n\\\u003cDisplayName\\\u003e element\n-----------------------\n\nUse in addition to the `name` attribute to label the policy in the\nmanagement UI proxy editor with a different, natural-language name. \n\n```text\n\u003cDisplayName\u003ePolicy Display Name\u003c/DisplayName\u003e\n```\n\n\\\u003cArrayElementCount\\\u003e element\n-----------------------------\n\nSpecifies the maximum number of elements allowed in an array. \n\n```text\n\u003cArrayElementCount\u003e20\u003c/ArrayElementCount\u003e\n```\n\n\\\u003cContainerDepth\\\u003e element\n--------------------------\n\nSpecifies the maximum allowed containment depth, where the containers are objects or arrays.\nFor example, an array containing an object which contains an object would result in a containment\ndepth of 3. \n\n```text\n\u003cContainerDepth\u003e10\u003c/ContainerDepth\u003e\n```\n\n\\\u003cObjectEntryCount\\\u003e element\n----------------------------\n\nSpecifies the maximum number of entries allowed in an object. \n\n```text\n\u003cObjectEntryCount\u003e15\u003c/ObjectEntryCount\u003e\n```\n\n\\\u003cObjectEntryNameLength\\\u003e element\n---------------------------------\n\nSpecifies the maximum string length allowed for a property name within an object. \n\n```text\n\u003cObjectEntryNameLength\u003e50\u003c/ObjectEntryNameLength\u003e\n```\n\n\\\u003cSource\\\u003e element\n------------------\n\nMessage to be screened for JSON payload attacks. This is most commonly set to\n`request`, as you will typically need to validate inbound requests from client apps.\nWhen set to `message`, this element will automatically evaluate the request message\nwhen attached to the request flow and the response message when attached to the response\nflow. \n\n```text\n\u003cSource\u003erequest\u003c/Source\u003e\n```\n\n\\\u003cStringValueLength\\\u003e element\n-----------------------------\n\nSpecifies the maximum length allowed for a string value. \n\n```text\n\u003cStringValueLength\u003e500\u003c/StringValueLength\u003e\n```\n\nError reference\n---------------\n\n| **Note:** This policy executes only if the `Content-Type` of the request or response header is set to `application/json.`\n\n\nThis section describes the fault codes and error messages that are returned and fault variables\nthat are set by Apigee when this policy triggers an error.\nThis information is important to know if you are developing fault rules to\nhandle faults. To learn more, see [What you need to know about policy errors](/apigee/docs/api-platform/fundamentals/what-you-need-know-about-policy-errors) and [Handling faults](/apigee/docs/api-platform/fundamentals/fault-handling).\n\n### Runtime errors\n\nThese errors can occur when the policy executes.\n\n### Deployment errors\n\nNone.\n\n### Fault variables\n\nThese variables are set when this policy triggers an error. For more information, see [What you need to know\nabout policy errors](/apigee/docs/api-platform/fundamentals/what-you-need-know-about-policy-errors).\n\n### Example error response\n\n```text\n{\n \"fault\": {\n \"faultstring\": \"JSONThreatProtection[JPT-SecureRequest]: Execution failed. reason: JSONThreatProtection[JTP-SecureRequest]: Exceeded object entry name length at line 2\",\n \"detail\": {\n \"errorcode\": \"steps.jsonthreatprotection.ExecutionFailed\"\n }\n }\n}\n```\n\n### Example fault rule\n\n```text\n\u003cFaultRule name=\"JSONThreatProtection Policy Faults\"\u003e\n \u003cStep\u003e\n \u003cName\u003eAM-CustomErrorResponse\u003c/Name\u003e\n \u003cCondition\u003e(fault.name Matches \"ExecutionFailed\") \u003c/Condition\u003e\n \u003c/Step\u003e\n \u003cCondition\u003e(jsonattack.JPT-SecureRequest.failed = true) \u003c/Condition\u003e\n\u003c/FaultRule\u003e\n```\n\n\u003cbr /\u003e\n\nSchemas\n-------\n\n| **Sample:** See our [GitHub\n| repository](https://github.com/apigee/api-platform-samples/tree/master/schemas/policy) samples for the most recent schemas.\n\nUsage notes\n-----------\n\nLike XML-based services, APIs that support JavaScript object notation (JSON) are vulnerable to\ncontent-level attacks. Simple JSON attacks attempt to use structures that overwhelm JSON parsers\nto crash a service and induce application-level denial-of-service attacks. All settings are\noptional and should be tuned to optimize your service requirements against potential\nvulnerabilities.\n\nRelated topics\n--------------\n\n[JSONtoXML policy](/apigee/docs/api-platform/reference/policies/json-xml-policy)\n\n[XMLThreatProtection policy](/apigee/docs/api-platform/reference/policies/xml-threat-protection-policy)\n\n[RegularExpressionProtection policy](/apigee/docs/api-platform/reference/policies/regular-expression-protection)"]]
