---
schema_version: "1"
id: bf97e51222d7ac31bfba606276406ad9403b6ac40e9a86e568184fbfded236d4
title: JSON Threat Protection Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/latest/policies-included-json-threat-protection.md
canonical_url: https://docs.mulesoft.com/gateway/latest/policies-included-json-threat-protection
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 2978d43fbdb294b97c077d412cf7513a3927330da211a03cd5edcbfd3ac84adc
description: MuleSoft Documentation Site
release: "1.14"
latest: true
---
---
product: Omni Gateway
version: 1.14
is-latest-version: true
keywords: json threat protection, api gateway, flex gateway, gateway, policy
---

# JSON Threat Protection Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>JSON Threat Protection</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Protects against malicious JSON in API requests</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.4.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/json-threat-protection-release-notes">JSON Threat Protection Policy</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>400 - Bad Request</p></td></tr></tbody></table>

## Summary

Applications processing JSON requests are susceptible to attacks characterized by unusual inflation
of elements and nesting levels. Attackers use recursive techniques to consume memory resources.
Dramatic swings in the size of the application data often signal a security problem. The JSON Threat
Protection policy helps protect your applications from such intrusions.

If you find that attacks on your Anypoint Platform setup are difficult to detect, design your
services architecture with layers of protection in addition to JSON Threat Protection.

> [!NOTE] The JSON Threat Protection policy doesn’t support multi-part form requests.

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: json-threat-protection-flex config: maxContainerDepth: <int> // OPTIONAL
maxObjectEntryCount: <int> // OPTIONAL maxObjectEntryNameLength: <int> // OPTIONAL
maxArrayElementCount: <int> // OPTIONAL maxStringValueLength: <int> // OPTIONAL

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>maxContainerDepth</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>-1</p></div></div></td><td><div><div><p>Specifies the maximum nested depth. JSON allows you to nest the containers (object and array) in any order to any depth. Specifying -1 indicates that the field value has no limits.</p></div></div></td></tr><tr><td><div><div><p><code>maxObjectEntryCount</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>-1</p></div></div></td><td><div><div><p>Specifies the maximum number of entries in an object. Specifying -1 indicates that the field value has no limits.</p></div></div></td></tr><tr><td><div><div><p><code>maxObjectEntryNameLength</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>-1</p></div></div></td><td><div><div><p>Specifies the maximum string length of an object’s entry name. Specifying -1 indicates that the field value has no limits.</p></div></div></td></tr><tr><td><div><div><p><code>maxArrayElementCount</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>-1</p></div></div></td><td><div><div><p>Specifies the maximum number of elements in an array. Specifying -1 indicates that the field value has no limits.</p></div></div></td></tr><tr><td><div><div><p><code>maxStringValueLength</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>-1</p></div></div></td><td><div><div><p>Specifies the maximum string value length. Specifying -1 indicates that the field value has no limits.</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

```yaml
- policyRef:
    name: json-threat-protection-flex
  config:
    maxContainerDepth: 10
    maxObjectEntryCount: 10000
    maxObjectEntryNameLength: 80
    maxArrayElementCount: 10000
    maxStringValueLength: 255
```

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col> <col></colgroup><tbody><tr><td><p><strong>Field</strong></p></td><td><p><strong>Description</strong></p></td><td><p><strong>Default</strong></p></td><td><p><strong>Required</strong></p></td></tr><tr><td><p>Maximum Container Depth</p></td><td><p>Specifies the maximum nested depth. JSON allows you to nest the containers (object and array) in any order to any depth</p></td><td><p>-1</p></td><td><p>false</p></td></tr><tr><td><p>Maximum String Value Length</p></td><td><p>Specifies the maximum length of a string value</p></td><td><p>-1</p></td><td><p>false</p></td></tr><tr><td><p>Maximum Object Entry Name Length</p></td><td><p>Specifies the maximum string length of an object’s entry name</p></td><td><p>-1</p></td><td><p>false</p></td></tr><tr><td><p>Maximum Object Entry Count</p></td><td><p>Specifies the maximum number of entries in an object</p></td><td><p>-1</p></td><td><p>false</p></td></tr><tr><td><p>Maximum Array Element Count</p></td><td><p>Specifies the maximum number of elements in an array</p></td><td><p>-1</p></td><td><p>false</p></td></tr></tbody></table>

> [!NOTE] A value of -1 indicates that the field value has no limits.

## Payload Example

If your payload contains the following example JSON:

{ "Players":\[ { "Name":"Sachin", "Email":"sachin.tendulkar@example.com" }, { "Name":"Suryakumar",
"email":"Surya@example.com" }, { "Name":"Bhuvi", "email":"bhuvi@example.com" }, { "Name":"Jonty",
"Email":"jonty@example.com" } \] }

The policy defines the example parameter values as follows:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Value</th><th>Explanation</th></tr></thead><tbody><tr><td><p>Maximum Container Depth</p></td><td><p>3</p></td><td><p>The depth of the <code>Name</code> and <code>Email</code> entries</p></td></tr><tr><td><p>Maximum String Value Length</p></td><td><p>28</p></td><td><p>The length of <code>sachin.tendulkar@example.com</code></p></td></tr><tr><td><p>Maximum Object Entry Name Length</p></td><td><p>7</p></td><td><p>The length of the <code>Players</code> object entry name</p></td></tr><tr><td><p>Maximum Object Entry Count</p></td><td><p>2</p></td><td><p>The number of entries in each <code>Players</code> object</p></td></tr><tr><td><p>Maximum Array Element Count</p></td><td><p>4</p></td><td><p>The number of elements in the <code>Players</code> array</p></td></tr></tbody></table>