[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[[["\u003cp\u003eThis content is relevant to both Apigee and Apigee hybrid users, detailing various security measures.\u003c/p\u003e\n"],["\u003cp\u003eMalicious API consumers often use message content as an attack vector, potentially compromising backend services.\u003c/p\u003e\n"],["\u003cp\u003eJSONThreatProtection and XMLThreatProtection policies can mitigate denial-of-service attacks by preventing the overwhelming of parsers with specific structures.\u003c/p\u003e\n"],["\u003cp\u003eThe RegularExpressionProtection policy can help safeguard against content-based attacks, including SQL-injection attempts within headers, parameters, or payload content.\u003c/p\u003e\n"]]],[],null,["# Content-based security\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nMessage content is a significant attack vector used by malicious API consumers. API Services\nprovides a set of Policy types to mitigate the potential for your backend services to be\ncompromised by attackers or by malformed request payloads.\n| **Note:** This video was recorded with a previous version of the Apigee UI; however, the concepts are still valid.\n\nThe following video provides an overview and focuses on protecting against SQL injection\nattacks.\n\nJSON threat protection\n----------------------\n\nJSON attacks attempt to use structures that overwhelm JSON parsers to crash a service and\ninduce application-level denial-of-service attacks.\n\nSuch attacks can be mitigated using the JSONThreatProtection Policy type.\n\nSee [JSON Threat\nProtection policy](/apigee/docs/api-platform/reference/policies/json-threat-protection-policy).\n\nXML threat protection\n---------------------\n\nXML attacks attempt to use structures that overwhelm XML parsers to crash a service and induce\napplication-level denial-of-service attacks.\n\nSuch attacks can be mitigated using the XMLThreatProtection Policy type.\n\nSee [XML Threat\nProtection policy](/apigee/docs/api-platform/reference/policies/xml-threat-protection-policy).\n\nGeneral content protection\n--------------------------\n\nSome content-based attacks use specific constructs in HTTP headers, query parameters, or\npayload content to attempt to execute code. An example is SQL-injection attacks. Such attacks can\nbe mitigated using the RegularExpressionProtection Policy type.\n\nSee [Regular\nExpression Protection policy](/apigee/docs/api-platform/reference/policies/regular-expression-protection)."]]
