What's Apigee's recommended best practices/views on sanitization in a context of security and API management?

[anilsr]

Should the libraries like https://github.com/owasp/json-sanitizer be mandatory or optional? Is there an overlap between JSON sanitization and JSON Threat protection? Anyone using sanitization policies? Any other relevant considerations?

~~Q:S:S~~

[davissean]

@Yuriy

may disagree, but I feel the performance overhead of a policy like this may outweigh the benefits. I would not recommend this for all APIs, but only those with specific security concerns. It is likely that this could be implemented in the backend, so the performance of the API tier would not be affected.