Implementing Api Threat Protection With Apigee

Implementing API Threat Protection with Apigee

Overview

Google Apigee is an enterprise API management platform that provides native security policies for threat protection, including JSON and XML content validation, OAuth 2.0 enforcement, SpikeArrest rate limiting, regular expression threat protection, and Advanced API Security for detecting malicious clients and API abuse patterns. Apigee operates as a reverse proxy that intercepts all API traffic, applying security policies before requests reach backend services, effectively shielding APIs against the OWASP API Security Top 10 threats.

When to Use

• When deploying or configuring implementing api threat protection with apigee capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Google Cloud Platform account with Apigee organization provisioned
• Apigee X or Apigee hybrid environment configured
• Backend API services deployed and accessible from Apigee
• Google Cloud CLI (gcloud) installed and authenticated
• OpenAPI specification for target APIs
• Understanding of Apigee proxy bundle structure

Core Security Policies

1. JSON Threat Protection

Protects against JSON-based denial-of-service attacks by limiting structural depth, entry counts, and string lengths:

    JSON Threat Protection
    request
    
    50
    25
    100
    5
    500

2. XML Threat Protection

Shields against XML bombs, XXE attacks, and oversized XML payloads:

    XML Threat Protection
    request
    
        50
        50
        20
        50
    
    
        1000
        500
        256
        256
        256
    
    
        5
        5
        3
        25
    

3. Regular Expression Threat Protection

Detects SQL injection, XSS, and other injection patterns in request parameters:

    Regex Injection Protection
    request
    false

    
    
        [\s]*((delete)|(exec)|(drop\s*table)|(insert)|(shutdown)|(update)|(\bor\b))
    

    
    
        [\s]*<\s*script\b[^>]*>[^<]+<\s*/\s*script\s*>
    

    
    
        [\r\n]
    

    
    
        (/\.\.)|(\.\./)
    

    
    
        $.*
        [\s]*((delete)|(exec)|(drop\s*table)|(insert)|(shutdown)|(update))
    

4. SpikeArrest Policy

Prevents traffic spikes from overwhelming backend services:

    API Spike Arrest
    30ps 
    
    
    true

5. OAuth 2.0 Token Validation

    Verify OAuth 2.0 Access Token
    VerifyAccessToken
    false
    request.header.Authorization
    
        authorization_code
        client_credentials
    
    read write
    

6. API Key Validation

    Verify API Key
    

Proxy Bundle Configuration

Complete Secure Proxy Flow

    
        
            
            
                Verify-OAuth-Token
            
            
            
                Spike-Arrest-1
            
            
            
                JSON-Threat-Protection-1
                request.header.Content-Type = "application/json"
            
            
                XML-Threat-Protection-1
                request.header.Content-Type = "text/xml"
            
            
            
                RegEx-Threat-Protection-1
            
            
            
                CORS-Policy
            
        
        
            
            
                Remove-Internal-Headers
            
            
            
                Add-Security-Headers
            
        
    

    
        
            Additional protection for sensitive endpoints
            
                
                    Quota-Strict
                
            
            (proxy.pathsuffix MatchesPath "/admin/**") or
                       (proxy.pathsuffix MatchesPath "/users/*/sensitive")
        
    

    
        /v1
        secure
    

    
        default
    

Security Headers Policy

    Add Security Response Headers
    
        
            nosniff
            DENY
            max-age=31536000; includeSubDomains
            no-store, no-cache, must-revalidate
            default-src 'none'
            {messageid}
        
    
    
        
            
            
        
    
    false
    

Advanced API Security

Enable Apigee's Advanced API Security add-on for machine-learning-based threat detection:

# Enable Advanced API Security on Apigee X instance
gcloud apigee organizations update $ORG_NAME \
  --advanced-api-security-config=enabled

# View detected abuse alerts
gcloud apigee apis security-reports list \
  --organization=$ORG_NAME \
  --environment=$ENV_NAME

# Create security action to block suspicious traffic
gcloud apigee security-actions create \
  --organization=$ORG_NAME \
  --environment=$ENV_NAME \
  --action-type=DENY \
  --condition-type=IP_ADDRESS \
  --condition-values="192.168.1.100,10.0.0.50" \
  --description="Block identified malicious IPs"

Deployment

# Deploy proxy bundle with security policies
gcloud apigee apis deploy \
  --api=$API_NAME \
  --environment=$ENV_NAME \
  --revision=$REVISION \
  --organization=$ORG_NAME

# Validate deployment
gcloud apigee apis list-deployments \
  --api=$API_NAME \
  --organization=$ORG_NAME

References

• Apigee JSON Threat Protection: https://cloud.google.com/apigee/docs/api-platform/reference/policies/json-threat-protection-policy
• Google Cloud Apigee Security Best Practices: https://cloud.google.com/architecture/best-practices-securing-applications-and-apis-using-apigee
• Apigee Advanced API Security: https://docs.cloud.google.com/apigee/docs/api-security
• Apigee OWASP API Top 10: https://docs.apigee.com/api-platform/faq/owasp-top-api-threats
• Wallarm Apigee Security Policies Guide: https://lab.wallarm.com/what/apigee-api-security-policies-howto/

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: pinkpixel-dev
• Source: pinkpixel-dev/skills-collection-2
• License: MIT

Install and usage instructions live in the source repository linked above.