JSON Content threat policy not working as expected?

[#1]

Hello, we are interested in using this policy but could not find enough details from the Apigee doc. We added this policy to our proxy "Test_Proxy1" (demo9 Organization).

<JSONThreatProtection name="JSON-Threat-Protection"> 
  <DisplayName>JSON Threat Protection</DisplayName> 
  <Properties/> 
  <ArrayElementCount>1</ArrayElementCount> 
  <ContainerDepth>-1</ContainerDepth> 
  <ObjectEntryCount>-1</ObjectEntryCount> 
  <ObjectEntryNameLength>-1</ObjectEntryNameLength> 
  <Source>request</Source> 
  <StringValueLength>-1</StringValueLength> 
</JSONThreatProtection>

We sent a request which will return array in response, ( the request will return the number of facility for a given organization), as per this policy set up now, there should be an error if the ArrayElementCount is more than 1.

Request we sent :

http://demo9-test.apigee.net/test_proxy/v0/orgs/10000003/facs/1/floors?apikey=y8yAHdA8JTBWE64nYAoUrA...

Response we received:

[
  { "orgId": 10000003, "facId": 1, "floorDesc": "2"},
  { "orgId": 10000003, "facId": 1, "floorDesc": "3"},
  { "orgId": 10000003, "facId": 1, "floorDesc": "4"}
]

Since we set ArrayElementCount =1, I expect the error code to be JSONThreatProtection[{0}]: Exceeded array element count at line {1} but on the other hand it doesnt show any error though the response has more than one element in array.

Are we missing something here, can someone clarify?

thanks !

[Former Community Member]

@HariniJayaraman

Which API Proxy are you trying this in? I can take a look at the config

[#3]

https://enterprise.apigee.com/platform/demo9/proxies/Test_Proxy1/develop/1

Proxy Name : Test_Proxy1

[Former Community Member · Accepted solution]

@HariniJayaraman

Yes, you're missing something. 🙂 You've added the protection policy in the request flow. You'd want the protection policy in the response flow (since you want the policy applied to the response).

[#5]

Perfect yes, it works on response and I also modified <source> to message as below. We are going to test couple of more scenarios , and keep this thread posted if any issues.

<JSONThreatProtection name="JSON-Threat-Protection"> 
  <DisplayName>JSON Threat Protection</DisplayName> 
  <Properties/> 
  <ArrayElementCount>1</ArrayElementCount> 
  <ContainerDepth>-1</ContainerDepth> 
  <ObjectEntryCount>-1</ObjectEntryCount> 
  <ObjectEntryNameLength>-1</ObjectEntryNameLength> 
  <!-- Source:message works on response when in response flow -->
  <Source>message</Source>
  <StringValueLength>-1</StringValueLength> 
</JSONThreatProtection>