Azure API management - Script injection/SQL injection prevention

Question

Does Azure API Management support prevention of sql injection or script injection? Are there any policies that can be utilized for this?

Answer 1

@Nagashree Balasundaram Thanks for your response. APIM does have the validation policy where your request can be validated against the schemas defined in the API definition or supplementary JSON or XML schemas as documented here. Apart from this I don't see any other policy out of box that can help you in validating it. The alternative would be creating your custom solution to validate it and deploy it to azure function or HTTP/HTTPS call. Now at the APIM end you leverage the Send request policy to call your custom service for the validation and according to the response of your service you can either proceed the backend call or return the error response.

Answer 2

API management just manages access to your API amongst other API-management related concerns. I'm not sure what script/SQL injection has to do with this as neither of those are related to APIs. Of course if your API accepts either scripts or SQL data then the responsibility would be on you to validate your inputs before doing any work in your API (like you would for any other data).