O conteúdo da mensagem é um vetor de ataque significativo usado por consumidores de API mal-intencionados. Os serviços de API fornecem um conjunto de tipos de política para reduzir o potencial de seus serviços de back-end serem comprometidos por invasores ou por payloads de solicitação malformados.
O vídeo a seguir fornece uma visão geral e se concentra na proteção contra ataques de injeção de SQL.
Proteção de ameaças JSON
Os ataques JSON usam a estrutura para sobrecarregar os analisadores JSON
de causar falha em um serviço e induzir ataques de negação de serviço no nível do aplicativo.
Esses ataques podem ser atenuados com o tipo de política JSONThreaProtection.
Os ataques XML usam a estrutura para sobrecarregar os analisadores XML
de causar falha em um serviço e induzir ataques de negação de serviço no nível do aplicativo.
Esses ataques podem ser atenuados usando o tipo de política XMLThreatProtection.
Alguns ataques baseados em conteúdo usam construções específicas em cabeçalhos HTTP, parâmetros de consulta ou conteúdo de payload para tentar executar o código. Um exemplo são ataques de injeção de SQL. Esses ataques podem ser atenuados com o tipo de política RegularExpressionProtection.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-18 UTC."],[[["\u003cp\u003eThis content is relevant to both Apigee and Apigee hybrid users, detailing various security measures.\u003c/p\u003e\n"],["\u003cp\u003eMalicious API consumers often use message content as an attack vector, potentially compromising backend services.\u003c/p\u003e\n"],["\u003cp\u003eJSONThreatProtection and XMLThreatProtection policies can mitigate denial-of-service attacks by preventing the overwhelming of parsers with specific structures.\u003c/p\u003e\n"],["\u003cp\u003eThe RegularExpressionProtection policy can help safeguard against content-based attacks, including SQL-injection attempts within headers, parameters, or payload content.\u003c/p\u003e\n"]]],[],null,["# Content-based security\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nMessage content is a significant attack vector used by malicious API consumers. API Services\nprovides a set of Policy types to mitigate the potential for your backend services to be\ncompromised by attackers or by malformed request payloads.\n| **Note:** This video was recorded with a previous version of the Apigee UI; however, the concepts are still valid.\n\nThe following video provides an overview and focuses on protecting against SQL injection\nattacks.\n\nJSON threat protection\n----------------------\n\nJSON attacks attempt to use structures that overwhelm JSON parsers to crash a service and\ninduce application-level denial-of-service attacks.\n\nSuch attacks can be mitigated using the JSONThreatProtection Policy type.\n\nSee [JSON Threat\nProtection policy](/apigee/docs/api-platform/reference/policies/json-threat-protection-policy).\n\nXML threat protection\n---------------------\n\nXML attacks attempt to use structures that overwhelm XML parsers to crash a service and induce\napplication-level denial-of-service attacks.\n\nSuch attacks can be mitigated using the XMLThreatProtection Policy type.\n\nSee [XML Threat\nProtection policy](/apigee/docs/api-platform/reference/policies/xml-threat-protection-policy).\n\nGeneral content protection\n--------------------------\n\nSome content-based attacks use specific constructs in HTTP headers, query parameters, or\npayload content to attempt to execute code. An example is SQL-injection attacks. Such attacks can\nbe mitigated using the RegularExpressionProtection Policy type.\n\nSee [Regular\nExpression Protection policy](/apigee/docs/api-platform/reference/policies/regular-expression-protection)."]]
