Json threat protection on large payloads

[mehuljain]

HI guys, what i'd like to know is that.....is there any way possible to use json protection policy on large JSON request payloads.....as i know how the policy works.....but what if the payloads has no. of different elements and array count on each different key and values pair .

As for now...i couldn't find any new way to look out for the answer

[cjking · Accepted solution]

You'll want to pick the maximum realistic for each category.

For example, if your json object has 3 arrays, with the following maximum sizes:

A) 10

B) 20

C) 30

Then you'll want to pick 30 (or 30 + headroom depending on your level of certainty) for ArrayElementCount.

JSONThreatProtection is not designed to type-check your JSON Payloads (you could do that in JS if you wanted though), but to protect the backend JSON parsing from resource exhaustion attacks. Your values should be sufficiently low that attackers can't DoS your backend.