---
schema_version: "1"
id: cb08326eeacce12beff4c653521ac6296a01503219a859f6f6bac6b5aca5f411
title: Injection Protection Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.12/policies-included-injection-protection.md
canonical_url: https://docs.mulesoft.com/gateway/1.12/policies-included-injection-protection
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 6ed7ed72103cf8b18f20c65344206534d11123ba7e2a205c295fa8846e3075a6
description: MuleSoft Documentation Site
release: "1.12"
latest: false
---
---
product: Omni Gateway
version: 1.12
keywords: sql injection, xss, injection protection, api gateway, flex gateway, gateway, policy
---

# Injection Protection Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>Injection Protection</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Scans incoming requests to protect against SQL, XSS, and custom injection attacks</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Flex Gateway version available</strong></p></td><td><p>v1.12.0</p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p><code>400</code> - Bad Request</p></td></tr></tbody></table>

## Summary

The Injection Protection policy scans incoming request headers, path, query string, and body for SQL
injection, XSS (Cross-Site Scripting), and custom injection attacks. The policy provides built-in
protections againt SQL and XSS attacks. Configure custom protections by defining regex patterns that
the policy should scan for.

The policy checks the request against the enabled built-in and custom rules. Depending on wether
**Reject Requests** is enabled, the policy either:

- Rejects the request and returns `400` (Bad Request) with the added response header
  `x-injection-protection: blocked`.

- Allows the request to reach the backend service and logs a policy violation.

## Configuring Policy Parameters

### Flex Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: injection-protection-flex config: builtInProtections: \["sql", "xss"\] //
REQUIRED: include "sql", "xss", or both customProtections: \[\] // OPTIONAL: list of { name:
<string>, regex: <string> } protectPathAndQuery: <bool> // REQUIRED protectHeaders: <bool> //
REQUIRED protectBody: <bool> // REQUIRED headersToProtect: <string> // OPTIONAL, default: "" (empty
= all headers) rejectRequests: <bool> // REQUIRED: true = reject with 400, false = allow and log

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>builtInProtections</code></p></div></div></td><td><div><div><p>Yes (at least one protection required)</p></div></div></td><td><div><div><p>—</p></div></div></td><td><div><div><p>The built-in protection types to enable. Valid values are <code>"sql"</code>, <code>"xss"</code>, or both. SQL protection detects patterns such as tautologies (for example, <code>OR 1=1</code>), comment-based injection (<code>--</code>, <code>#</code>), union/select statements, and keywords such as <code>DROP</code> and <code>DELETE</code>. XSS protection detects patterns such as script and iframe tags, event handlers, and common script schemes.</p></div></div></td></tr><tr><td><div><div><p><code>customProtections</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div></div></td><td><div><div><p>Custom protection rules for application-specific injection types. Each rule requires a <code>name</code> and a <code>regex</code> pattern. Values must be valid and not empty.</p></div></div></td></tr><tr><td><div><div><p><code>protectPathAndQuery</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>—</p></div></div></td><td><div><div><p>If <code>true</code>, the policy checks the request path and query string. The policy applies URL decoding to the path and query before matching.</p></div></div></td></tr><tr><td><div><div><p><code>protectHeaders</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>—</p></div></div></td><td><div><div><p>If <code>true</code>, the policy checks request headers. <code>headersToProtect</code> specifies which headers the policy checks.</p></div></div></td></tr><tr><td><div><div><p><code>headersToProtect</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>"" (empty)</p></div></div></td><td><div><div><p>A case-insensitive, comma-separated list of header names to check. If the value is empty, the policy checks all headers. This parameter is ignored if <code>protectHeaders</code> is <code>false</code>.</p></div></div></td></tr><tr><td><div><div><p><code>protectBody</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>—</p></div></div></td><td><div><div><p>If <code>true</code>, the policy checks the request body for injection patterns.</p></div></div></td></tr><tr><td><div><div><p><code>rejectRequests</code></p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>—</p></div></div></td><td><div><div><p>If <code>true</code>, the gateway rejects matching requests with a <code>400</code> response code and a JSON error message. If <code>false</code>, the gateway allows matching requests and logs a warning.</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

\- policyRef: name: injection-protection-flex config: builtInProtections: \["sql", "xss"\]
customProtections: \[\] protectPathAndQuery: true protectHeaders: true headersToProtect:
"referer,user-agent" protectBody: true rejectRequests: true

### Managed Flex Gateway and Flex Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th>Field</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Built-in Protections</p></div></div></td><td><div><div><p>The built-in SQL and XSS injection protection settings.</p></div></div></td></tr><tr><td><div><div><p>Custom Protections</p></div></div></td><td><div><div><p>The rules defined with a name and regex pattern for custom injection types.</p></div></div></td></tr><tr><td><div><div><p>Protect Path and Query</p></div></div></td><td><div><div><p>If enabled, the gateway checks the request path and query string.</p></div></div></td></tr><tr><td><div><div><p>Protect Headers</p></div></div></td><td><div><div><p>If enadbled, the gateway checks the request headers.</p></div></div></td></tr><tr><td><div><div><p>Headers to Protect</p></div></div></td><td><div><div><p>List of header names to check. Leave empty to check all headers.</p></div></div></td></tr><tr><td><div><div><p>Protect Body</p></div></div></td><td><div><div><p>If enabled, the gateway checks the request body.</p></div></div></td></tr><tr><td><div><div><p>Reject Requests</p></div></div></td><td><div><div><p>If enabled, the gateway rejects matching requests with a <code>400</code> response code. Otherwise, the gateway allows them to reach the upstream service and logs a policy violation.</p></div></div></td></tr></tbody></table>