Submenu – API Security

API Security

+ button

Airlock Gateway can automatically validate API requests and responses against formal API specifications.

Use the + button to upload your API specifications.

  • API validation requires a license for the API Gateway feature.
  • After uploading the API specification:
  • Configure and enable Enforce API validation for a mapping on the mapping detail page, Tab – API Security.

Feature scope

The OpenAPI filter supports the validation of parameters (path, query, header, cookie). All data types and their constraints such as enum, pattern, format, value ranges and length ranges, are supported. Body content checks are only applied to JSON documents and binary data.

  • Requests not compliant with the specification are blocked and reported in the log using log_id WR-SG-BLOCK-115-00.
  • OpenAPI features currently not supported are reported in the log upon configuration loading using a log message with log_id SY-SG-CONF-115-01.

The following OpenAPI features are currently not supported:

  • Content-Types other than JSON
  • Multipart requests
  • Callbacks

API specification format must be in OpenAPI version 3.0 as JSON.

Specifications in other formats or versions, e.g., Swagger 2.0, must be converted prior to uploading. For Swagger to OpenAPI conversions, we recommend the Mermade converter, which is also available as a command-line tool.

Log messages

The following log messages are written by the OpenAPI filter during request handling:

  • WR-SG-BLOCK-115-00: Noncompliant API usage
    • constraint: provides detailed information on the violated constraint.
    • position: denotes the position in the validated request document/parameter where a constraint was violated
  • WR-SG-REJECT-115: OpenAPI configuration is invalid
    • The configuration could not be loaded correctly. See CONF-115 entries in the log messages for investigation and error analysis.

The following log messages are written by the OpenAPI configuration loader:

  • SY-SG-CONF-115-00: Config Loader: Error parsing OpenAPI specification
    • file: filename of the document where the error occurred
    • position: denotes the position in the specification where the error was found
  • SY-SG-CONF-115-01: Config Loader: Unsupported OpenAPI feature
    • file: filename of the document where the error occurred
    • position: denotes the position in the specification where the error was found
  • SY-SG-CONF-115-02: Config Loader: Config Loader: Error compiling pattern for OpenAPI string format
  • SY-SG-CONF-115-03: Config Loader: Config Loader: Error compiling pattern for OpenAPI Content-Type matching

Security gate expert settings

Certain aspects of the OpenAPI validation are controlled by expert settings:

Expert Setting Key

Description

OpenApi.StringFormat.*

Patterns for custom value formats referenced by name in specifications.

OpenApi.Authentication.*

Whitelisted parameters for OAuth2 and OpenID Connect security schemes.

OpenApi.Check.Response

Enable or disable response check (default "false").

OpenApi.ContentType.*

List of Content-Type patterns.

Request.Json.Limits.*

Thresholds for preventing DoS attacks against the JSON parser.

Further information and links

  • Submenu – License
  • Mapping detail page >> Tab – API Security
  • For API policy cookies, see: Values regarding API policy features