Halaman ini menjelaskan beberapa praktik terbaik untuk menggunakan Keamanan API Lanjutan.
Mengonfigurasi resolusi IP klien
Jika
algoritma penyelesaian IP klien default
tidak berfungsi untuk kasus penggunaan Anda, algoritma tersebut dapat disesuaikan per lingkungan. Lihat
resolusi IP klien.
Dengan mengonfigurasi setelan ini, Keamanan API Lanjutan dapat menemukan dan menggunakan alamat IP klien yang sesuai untuk setiap permintaan API, serta memastikan resolusi alamat IP klien yang konsisten di seluruh lingkungan Anda.
Header permintaan X-Forwarded-For (XFF) adalah header standar untuk mengidentifikasi alamat IP asal klien yang terhubung ke server web melalui server proxy. Banyak platform
menyediakan kemampuan untuk menghapus header XFF dari permintaan masuk untuk tujuan keamanan. Namun,
tindakan ini tidak direkomendasikan jika Anda menggunakan Keamanan API Lanjutan, karena algoritma
machine learning yang digunakannya memerlukan informasi alamat IP untuk mengidentifikasi traffic penyalahgunaan, dan untuk
menghitung skor keamanan.
Cara menentukan apakah platform Anda menghapus header XFF
Untuk menentukan apakah platform Anda menghapus header XFF, lakukan panggilan API seperti berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis guide covers best practices for utilizing Advanced API Security in both Apigee and Apigee hybrid environments.\u003c/p\u003e\n"],["\u003cp\u003eCustomizing client IP resolution is available per environment, allowing Advanced API Security to accurately identify and utilize the client IP address for each API request.\u003c/p\u003e\n"],["\u003cp\u003ePreserving X-Forwarded-For (XFF) headers is crucial for Advanced API Security, as the IP address data is needed to identify abuse traffic and calculate security scores.\u003c/p\u003e\n"],["\u003cp\u003eStripped XFF headers can be identified by making an API call, which will return "(not set)" if the headers are being removed.\u003c/p\u003e\n"]]],[],null,["# Advanced API Security best practices\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nThis page describes some best practices for working with Advanced API Security.\n\nConfigure client IP resolution\n------------------------------\n\nIf the\n[default client IP resolution algorithm](/apigee/docs/api-platform/system-administration/client-ip-resolution#default-client-ip-address-resolution)\ndoes not work for your use case, it can be customized per environment. See\n[client IP resolution](/apigee/docs/api-platform/system-administration/client-ip-resolution).\nConfiguring this setting allows\nAdvanced API Security to find and use the appropriate client IP address for each API request, and ensures\nconsistent client IP address resolution across your environment.\n\nIn order to use client IP resolution, you'll also need to\n[Preserve X-Forwarded-For request headers](#preserve-x-forwarded-for-request-headers).\n\nPreserve X-Forwarded-For request headers\n----------------------------------------\n\nThe X-Forwarded-For (XFF) request header is a standard header for identifying the originating\nIP addresses of clients connecting to a web server through a proxy server. Many platforms\nprovide the ability to strip off XFF headers from incoming requests for security\npurposes. However,\nthis is not recommended if you are using Advanced API Security, because the machine learning\nalgorithms it uses need the IP address information to identify abuse traffic, and to\ncalculate security scores.\n\n### How to determine if your platform is stripping off XFF headers\n\nTo determine if your platform is stripping off XFF headers, make an\nAPI call like the following: \n\n```\ncurl https://apigee.googleapis.com/v1/organizations/ORG/environments/ENV/stats/x_forwarded_for_ip?select=avg\\(total_response_time\\)&timeRange=9/24/2018%2000:00~10/25/2018%2000:00&timeUnit=day \\\n -H \"Authorization: Bearer $TOKEN\"\n```\n\nwhere \u003cvar translate=\"no\"\u003eORG\u003c/var\u003e is your organization and \u003cvar translate=\"no\"\u003eENV\u003c/var\u003e is an environment in the\norganization.\n\nIf your platform is stripping off XFF headers, this returns a response in which the first line will be \n\n```\n \"name\": \"(not set)\",\n```\n\nThe `(not set)` in the response means your platform is\nstripping off XFF headers."]]
