Threat protection policies

Threat protection policies prevent malicious attacks from client applications that typically involve large, recursive payloads, and SQL injections. You can limit the size of things, such as maximum message size, maximum number of requests, and maximum node depth and text node length, in the XML document. You can configure the global threat protection policies and rules for all the incoming requests that come through the external port of webMethods API Gateway. These policies and rules is enforced by an webMethods API Gateway based on your configuration.

You must have the webMethods API Gateway's manage threat protection functional privilege to configure the policies and rules such as:

  • Global Denial of Service
  • Denial of Service by IP
  • Rules

In addition, the webMethods API Gateway administrator can configure the necessary mobile devices and applications for which access should be denied. They can configure and customize the deny and alert rules, and manage the denied IPs.

When configuring the threat protection policy in a cluster, you set limits on the number of requests and concurrent requests an webMethods API Gateway instance can handle. These limitations apply during a specified time interval. Hence, if you add X number of webMethods API Gateway instances, the limitations set in the configuration increases by X times. For example, if you have 2 webMethods API Gateway instances and set the limitations as 100 requests per minute, then the webMethods API Gateway instances should be able to handle 200 requests per minute. When you add one more webMethods API Gateway instance, the processing capacity also increases to 300 requests per minute. Here, the webMethods API Gateway cluster used for Threat Protection does not act as a single unit.
Note: When you have configured a load balancer, the load balancer exposes the actual client IP address by using the X-Forwarded-For (XFF) headers. The watt.server.enterprisegateway.straightforwardness property specifies whether webMethods API Gateway uses or ignores the IP address in the XFF headers. By default, webMethods API Gateway ignores the client IP address and so the watt.server.enterprisegateway.ignoreXForwardedForHeader property is set to `true`. If you want webMethods API Gateway to use the actual client IP address present in the XFF, then set the watt.server.enterprisegateway.ignoreXForwardedForHeader property to false.