# Implementing API Threat Protection With Apigee

> 使用Google Apigee策略实施API威胁防护，包括JSON/XML威胁防护、OAuth 2.0、SpikeArrest和高级API安全（Advanced API Security），防御OWASP Top 10攻击。

- Skill: `killvxk/implementing-api-threat-protection-with-apigee` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add killvxk/implementing-api-threat-protection-with-apigee`
- Raw SKILL.md: https://api.skillmd.com/api/skills/killvxk/implementing-api-threat-protection-with-apigee/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: killvxk (https://skillmd.com/u/killvxk)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/killvxk/implementing-api-threat-protection-with-apigee

---


# 使用Apigee实施API威胁防护

## 概述

Google Apigee是一个企业级API管理平台，提供原生安全策略用于威胁防护，包括JSON和XML内容验证、OAuth 2.0强制执行、SpikeArrest速率限制、正则表达式威胁防护，以及用于检测恶意客户端和API滥用模式的高级API安全（Advanced API Security）。Apigee作为反向代理运行，拦截所有API流量，在请求到达后端服务前应用安全策略，有效防御OWASP API安全Top 10威胁。

## 前置条件

- 已预配Apigee组织的Google Cloud Platform账号
- 已配置Apigee X或Apigee hybrid环境
- 后端API服务已部署并可从Apigee访问
- 已安装并认证的Google Cloud CLI（gcloud）
- 目标API的OpenAPI规范
- 了解Apigee代理包（Proxy Bundle）结构

## 核心安全策略

### 1. JSON威胁防护

通过限制结构深度、条目数量和字符串长度，防护基于JSON的拒绝服务攻击：

```xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<JSONThreatProtection name="JSON-Threat-Protection-1">
    <DisplayName>JSON Threat Protection</DisplayName>
    <Source>request</Source>
    <!-- JSON结构最大嵌套深度 -->
    <ObjectEntryNameLength>50</ObjectEntryNameLength>
    <ObjectEntryCount>25</ObjectEntryCount>
    <ArrayElementCount>100</ArrayElementCount>
    <ContainerDepth>5</ContainerDepth>
    <StringValueLength>500</StringValueLength>
</JSONThreatProtection>
```

### 2. XML威胁防护

防御XML炸弹（XML Bomb）、XXE攻击和超大XML载荷：

```xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<XMLThreatProtection name="XML-Threat-Protection-1">
    <DisplayName>XML Threat Protection</DisplayName>
    <Source>request</Source>
    <NameLimits>
        <Element>50</Element>
        <Attribute>50</Attribute>
        <NamespacePrefix>20</NamespacePrefix>
        <ProcessingInstructionTarget>50</ProcessingInstructionTarget>
    </NameLimits>
    <ValueLimits>
        <Text>1000</Text>
        <Attribute>500</Attribute>
        <NamespaceURI>256</NamespaceURI>
        <Comment>256</Comment>
        <ProcessingInstructionData>256</ProcessingInstructionData>
    </ValueLimits>
    <StructureLimits>
        <NodeDepth>5</NodeDepth>
        <AttributeCountPerElement>5</AttributeCountPerElement>
        <NamespaceCountPerElement>3</NamespaceCountPerElement>
        <ChildCount>25</ChildCount>
    </StructureLimits>
</XMLThreatProtection>
```

### 3. 正则表达式威胁防护

检测请求参数中的SQL注入、XSS和其他注入模式：

```xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<RegularExpressionProtection name="RegEx-Threat-Protection-1">
    <DisplayName>Regex Injection Protection</DisplayName>
    <Source>request</Source>
    <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>

    <!-- SQL注入模式 -->
    <QueryParam name="*">
        <Pattern>[\s]*((delete)|(exec)|(drop\s*table)|(insert)|(shutdown)|(update)|(\bor\b))</Pattern>
    </QueryParam>

    <!-- XSS模式 -->
    <QueryParam name="*">
        <Pattern>[\s]*&lt;\s*script\b[^&gt;]*&gt;[^&lt;]+&lt;\s*/\s*script\s*&gt;</Pattern>
    </QueryParam>

    <!-- 响应头注入 -->
    <Header name="*">
        <Pattern>[\r\n]</Pattern>
    </Header>

    <!-- URI路径遍历 -->
    <URIPath>
        <Pattern>(/\.\.)|(\.\./)</Pattern>
    </URIPath>

    <!-- JSON载荷注入 -->
    <JSONPayload>
        <JSONPath>$.*</JSONPath>
        <Pattern>[\s]*((delete)|(exec)|(drop\s*table)|(insert)|(shutdown)|(update))</Pattern>
    </JSONPayload>
</RegularExpressionProtection>
```

### 4. SpikeArrest策略

防止流量峰值压垮后端服务：

```xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<SpikeArrest name="Spike-Arrest-1">
    <DisplayName>API Spike Arrest</DisplayName>
    <Rate>30ps</Rate> <!-- 每秒30个请求（平滑处理） -->
    <Identifier ref="request.header.x-api-key"/>
    <MessageWeight ref="request.header.x-request-weight"/>
    <UseEffectiveCount>true</UseEffectiveCount>
</SpikeArrest>
```

### 5. OAuth 2.0令牌验证

```xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<OAuthV2 name="Verify-OAuth-Token">
    <DisplayName>Verify OAuth 2.0 Access Token</DisplayName>
    <Operation>VerifyAccessToken</Operation>
    <ExternalAuthorization>false</ExternalAuthorization>
    <ExternalAccessToken>request.header.Authorization</ExternalAccessToken>
    <SupportedGrantTypes>
        <GrantType>authorization_code</GrantType>
        <GrantType>client_credentials</GrantType>
    </SupportedGrantTypes>
    <Scope>read write</Scope>
    <GenerateResponse enabled="true"/>
</OAuthV2>
```

### 6. API密钥验证

```xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<VerifyAPIKey name="Verify-API-Key-1">
    <DisplayName>Verify API Key</DisplayName>
    <APIKey ref="request.header.x-api-key"/>
</VerifyAPIKey>
```

## 代理包配置

### 完整安全代理流程

```xml
<!-- apiproxy/proxies/default.xml -->
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ProxyEndpoint name="default">
    <PreFlow name="PreFlow">
        <Request>
            <!-- 步骤1：验证API密钥或OAuth令牌 -->
            <Step>
                <Name>Verify-OAuth-Token</Name>
            </Step>
            <!-- 步骤2：速率限制 -->
            <Step>
                <Name>Spike-Arrest-1</Name>
            </Step>
            <!-- 步骤3：威胁防护 -->
            <Step>
                <Name>JSON-Threat-Protection-1</Name>
                <Condition>request.header.Content-Type = "application/json"</Condition>
            </Step>
            <Step>
                <Name>XML-Threat-Protection-1</Name>
                <Condition>request.header.Content-Type = "text/xml"</Condition>
            </Step>
            <!-- 步骤4：注入防护 -->
            <Step>
                <Name>RegEx-Threat-Protection-1</Name>
            </Step>
            <!-- 步骤5：CORS强制执行 -->
            <Step>
                <Name>CORS-Policy</Name>
            </Step>
        </Request>
        <Response>
            <!-- 从响应中移除内部头 -->
            <Step>
                <Name>Remove-Internal-Headers</Name>
            </Step>
            <!-- 添加安全响应头 -->
            <Step>
                <Name>Add-Security-Headers</Name>
            </Step>
        </Response>
    </PreFlow>

    <Flows>
        <Flow name="sensitive-operations">
            <Description>敏感端点的额外保护</Description>
            <Request>
                <Step>
                    <Name>Quota-Strict</Name>
                </Step>
            </Request>
            <Condition>(proxy.pathsuffix MatchesPath "/admin/**") or
                       (proxy.pathsuffix MatchesPath "/users/*/sensitive")</Condition>
        </Flow>
    </Flows>

    <HTTPProxyConnection>
        <BasePath>/v1</BasePath>
        <VirtualHost>secure</VirtualHost>
    </HTTPProxyConnection>

    <RouteRule name="default">
        <TargetEndpoint>default</TargetEndpoint>
    </RouteRule>
</ProxyEndpoint>
```

### 安全响应头策略

```xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage name="Add-Security-Headers">
    <DisplayName>Add Security Response Headers</DisplayName>
    <Set>
        <Headers>
            <Header name="X-Content-Type-Options">nosniff</Header>
            <Header name="X-Frame-Options">DENY</Header>
            <Header name="Strict-Transport-Security">max-age=31536000; includeSubDomains</Header>
            <Header name="Cache-Control">no-store, no-cache, must-revalidate</Header>
            <Header name="Content-Security-Policy">default-src 'none'</Header>
            <Header name="X-Request-ID">{messageid}</Header>
        </Headers>
    </Set>
    <Remove>
        <Headers>
            <Header name="X-Powered-By"/>
            <Header name="Server"/>
        </Headers>
    </Remove>
    <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
    <AssignTo createNew="false" transport="http" type="response"/>
</AssignMessage>
```

## 高级API安全

在Apigee X实例上启用高级API安全（Advanced API Security）附加组件，进行基于机器学习的威胁检测：

```bash
# 在Apigee X实例上启用高级API安全
gcloud apigee organizations update $ORG_NAME \
  --advanced-api-security-config=enabled

# 查看检测到的滥用告警
gcloud apigee apis security-reports list \
  --organization=$ORG_NAME \
  --environment=$ENV_NAME

# 创建安全动作以封锁可疑流量
gcloud apigee security-actions create \
  --organization=$ORG_NAME \
  --environment=$ENV_NAME \
  --action-type=DENY \
  --condition-type=IP_ADDRESS \
  --condition-values="192.168.1.100,10.0.0.50" \
  --description="封锁已识别的恶意IP"
```

## 部署

```bash
# 部署带安全策略的代理包
gcloud apigee apis deploy \
  --api=$API_NAME \
  --environment=$ENV_NAME \
  --revision=$REVISION \
  --organization=$ORG_NAME

# 验证部署
gcloud apigee apis list-deployments \
  --api=$API_NAME \
  --organization=$ORG_NAME
```

## 参考资料

- Apigee JSON威胁防护: https://cloud.google.com/apigee/docs/api-platform/reference/policies/json-threat-protection-policy
- Google Cloud Apigee安全最佳实践: https://cloud.google.com/architecture/best-practices-securing-applications-and-apis-using-apigee
- Apigee高级API安全: https://docs.cloud.google.com/apigee/docs/api-security
- Apigee OWASP API Top 10: https://docs.apigee.com/api-platform/faq/owasp-top-api-threats
- Wallarm Apigee安全策略指南: https://lab.wallarm.com/what/apigee-api-security-policies-howto/