Konten pesan adalah vektor serangan signifikan yang digunakan oleh konsumen API berbahaya. Layanan API
menyediakan serangkaian jenis Kebijakan untuk memitigasi potensi layanan backend Anda disusupi oleh penyerang atau oleh payload permintaan yang salah format.
Video berikut memberikan ringkasan dan berfokus pada perlindungan terhadap serangan injeksi SQL.
Perlindungan dari ancaman JSON
Serangan JSON mencoba menggunakan struktur yang membebani parser JSON secara berlebihan untuk membuat layanan error dan
memicu serangan penolakan layanan tingkat aplikasi.
Serangan semacam itu dapat dimitigasi menggunakan jenis Kebijakan JSONThreatProtection.
Serangan XML mencoba menggunakan struktur yang membebani parser XML untuk membuat layanan error dan memicu
serangan penolakan layanan tingkat aplikasi.
Serangan semacam itu dapat dimitigasi menggunakan jenis Kebijakan XMLThreatProtection.
Beberapa serangan berbasis konten menggunakan konstruksi tertentu di header HTTP, parameter kueri, atau
konten payload untuk mencoba mengeksekusi kode. Contohnya adalah serangan injeksi SQL. Serangan semacam itu dapat dimitigasi menggunakan jenis Kebijakan RegularExpressionProtection.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[[["\u003cp\u003eThis content is relevant to both Apigee and Apigee hybrid users, detailing various security measures.\u003c/p\u003e\n"],["\u003cp\u003eMalicious API consumers often use message content as an attack vector, potentially compromising backend services.\u003c/p\u003e\n"],["\u003cp\u003eJSONThreatProtection and XMLThreatProtection policies can mitigate denial-of-service attacks by preventing the overwhelming of parsers with specific structures.\u003c/p\u003e\n"],["\u003cp\u003eThe RegularExpressionProtection policy can help safeguard against content-based attacks, including SQL-injection attempts within headers, parameters, or payload content.\u003c/p\u003e\n"]]],[],null,["# Content-based security\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nMessage content is a significant attack vector used by malicious API consumers. API Services\nprovides a set of Policy types to mitigate the potential for your backend services to be\ncompromised by attackers or by malformed request payloads.\n| **Note:** This video was recorded with a previous version of the Apigee UI; however, the concepts are still valid.\n\nThe following video provides an overview and focuses on protecting against SQL injection\nattacks.\n\nJSON threat protection\n----------------------\n\nJSON attacks attempt to use structures that overwhelm JSON parsers to crash a service and\ninduce application-level denial-of-service attacks.\n\nSuch attacks can be mitigated using the JSONThreatProtection Policy type.\n\nSee [JSON Threat\nProtection policy](/apigee/docs/api-platform/reference/policies/json-threat-protection-policy).\n\nXML threat protection\n---------------------\n\nXML attacks attempt to use structures that overwhelm XML parsers to crash a service and induce\napplication-level denial-of-service attacks.\n\nSuch attacks can be mitigated using the XMLThreatProtection Policy type.\n\nSee [XML Threat\nProtection policy](/apigee/docs/api-platform/reference/policies/xml-threat-protection-policy).\n\nGeneral content protection\n--------------------------\n\nSome content-based attacks use specific constructs in HTTP headers, query parameters, or\npayload content to attempt to execute code. An example is SQL-injection attacks. Such attacks can\nbe mitigated using the RegularExpressionProtection Policy type.\n\nSee [Regular\nExpression Protection policy](/apigee/docs/api-platform/reference/policies/regular-expression-protection)."]]
