We would like to have OWASP security features as part of API Management rather than using API gateway/WAF.
We would like to have OWASP security features as part of API Management rather than using API gateway/WAF.
18
votes
Jayesh Sonawane
shared this idea
2 comments
-
Chad
commented
Consider adding built in policy definitions similar to apigee:
https://docs.apigee.com/api-platform/reference/policies/xml-threat-protection-policy
https://docs.apigee.com/api-platform/reference/policies/json-threat-protection-policy
https://docs.apigee.com/api-platform/reference/policies/regular-expression-protection -
Chad
commented
This is especially critical for a native azure solution since you cannot put an App Gateway in front of APIM and still support Mutual Authentication with certificate checks.