Hi All.

How to protect APIs in API Gateway against XSS attacks. I have enabled SQL Injections and Json threat protection policies and we observed that when the json with scripts as string are passed i see the data is getting routed to downstream systems.

I see this getting posted to downstream systems

{
"fullname":"<script> hello </script>"

}

. If i pass in ' quotes i see SQL injection threat protection is getting triggered. 

{

"fullname":" '<script> hello </script>' "

}

So how to identify XSS and stop in the threat protection layer itself rather than passing the request to downstream systems.

Thanks

Abhijith

Hi @Abhijith Parre

Can you add more details about your system 

API Gateway version : 
API Gateway license : Standard or advance API Gateway
There is no out of box features to captures the XSS attack till version 10.11 and to use the custom scripts to catch the XSS attacks. 

Hi All.

How to protect APIs in API Gateway against XSS attacks. I have enabled SQL Injections and Json threat protection policies and we observed that when the json with scripts as string are passed i see the data is getting routed to downstream systems.

I see this getting posted to downstream systems

{
"fullname":"<script> hello </script>"

}

. If i pass in ' quotes i see SQL injection threat protection is getting triggered. 

{

"fullname":" '<script> hello </script>' "

}

So how to identify XSS and stop in the threat protection layer itself rather than passing the request to downstream systems.

Thanks

Abhijith