I have created an API on Azure API Management with this operation:

POST https://example.azure-api.net/product/check
content-type: application/json
{
    "productId":"a77swsa2"
}

productId is a string that cannot have more than 8 characters. How can I protect the API on Azure APIM so that I reject all requests that include a productId of more than 8 characters? Now I see it is possible to paste huge strings and it is all sent to the backend.

CodePudding user response：

You can do that in two ways:

1. Manually using choose policy and context.Request.Body.As<Jobject>() to parse request body as JObject and then inspect "productId" to check its length and if it's larger than 8 characters use return-response policy to fail the request.
2. If your API's schema is correct, you can make use of validate-content policy.