Validate POST request body in Azure API Manager - azure-api-management

Question

I'm trying to set up an inbound policy on an API in Azure API Manager that validates the JSON in POST request body before passing it on to the backend.
Should I be using a JSON schema and validate against that (how?) or if I should write my own code, using context.Request.Body to inspect each field in the request body or is it just plain wrong to try to validate a request body in APIM, should that be left to the backend?

Answer 1

We are currently validating in the API operations policy with a <set-body> to validate (and re-shape body if required). In this policy we're collecting all errors which we then throw with an exception:
<set-body>#{
var body = context.Request.Body.As<JObject>(true);
string businessSystemID = context.Request.Headers.GetValueOrDefault("SenderBusinessSystemID", "");
var result = new JObject();
string cleanUp = body.ToString().Replace("\r\n","");
var root = JObject.Parse(cleanUp);
var valid = false;
var errors = new JArray();
var returnValue = new JObject();
returnValue["errors"] = errors;
if(root["CostAllocation"] != null)
{
if(businessSystemID != string.Empty)
{
root["CostAllocation"]["SenderBusinessSystemID"] = businessSystemID;
}
if(root["CostAllocation"]["ReferenceID"] != null)
{
var referenceIDValidator = #"^[A-Z0-9]{0,35}$";
var referenceID = root["CostAllocation"]["ReferenceID"];
valid = new Regex(referenceIDValidator, RegexOptions.IgnoreCase).Match(referenceID.ToString()).Success;
if(!valid)
{
var error = new JObject();
error["property"] = "ReferenceID";
error["validator"] = referenceIDValidator;
error["value"] = referenceID;
error["message"] = "No valid 'ReferencedId'";
errors.Add(error);
}
}
if(root["CostAllocation"]["UserID"] != null)
{
var userIDValidator = #"^[\w]{4,12}$";
var userID = root["CostAllocation"]["UserID"];
valid = new Regex(userIDValidator, RegexOptions.IgnoreCase).Match(userID.ToString()).Success;
if(!valid)
{
var error = new JObject();
error["property"] = "UserID";
error["validator"] = userIDValidator;
error["value"] = userID;
error["message"] = "No valid 'UserID'";
errors.Add(error);
}
}
...
if(errors.Count > 0)
{
throw new Exception(returnValue.ToString());
}
return root.ToString(Newtonsoft.Json.Formatting.None);
}</set-body>
Exception is caught in <on-error>, handled and formatted:
<on-error>
<choose>
<when condition="#(context.LastError.Message.Contains("Expression evaluation failed")==true)">
<set-status code="400" reason="Bad request" />
</when>
<otherwise>
<set-status code="500" reason="Error" />
</otherwise>
</choose>
<set-body template="none">#{
return context.LastError.Message.Replace("Expression evaluation failed.","").Trim();
}</set-body>
<base />
</on-error>
We're aware that coding effort is high with this approach and would rather prefer for JSON schema checking natively supported directly in API Management. Having schema checking handled in a back-end and with that adding latency by passing on the request is not an option for us.
One option which I'm currently thinking of is parsing JSON schema in the API CI/CD process, generating a generic validation & replacing it in the API operations policy.

Answer 2

Validating payload is perfectly fine. Just be aware that doing so will require caching whole request body on APIM side which is not done by default. JSON schema validator is not available in policy expressions, so you have to resort to manual validation.