Why does Membrane sqlInjectionProtection return 500 Error inspecting REQUEST?

The plugin failed while it inspected the message, before it could decide whether it contains an SQL injection. In most cases the request URI or a parameter could not be parsed, or the body could not be read.

Does a detected SQL injection cause this 500 error?

No. A detected SQL injection is reported with a different error and a status of 400 or 502. The 500 means that the message could not be inspected at all.

How do I hide the details in Membrane error responses?

Enable production mode by adding a configuration document with production: true to your apis.yaml. The response then only contains a log key that you can look up in the gateway log.

500 Internal Server Error: Error Inspecting Message for SQL Injection

Membrane API Gateway returns 500 Internal Server Error with the detail Error inspecting REQUEST! or Error inspecting RESPONSE! when the sqlInjectionProtection plugin fails while it inspects a message, before it can decide whether the message contains an SQL injection. In most cases the client sent a URI or parameters that Membrane cannot parse.

The Error Response

The response contains the status 500 Internal Server Error, the title Internal server error., the detail Error inspecting REQUEST! or Error inspecting RESPONSE!, the problem type https://membrane-api.io/problems/internal and a link to this page. In development mode, the exception message is included as well. The type internal means that the gateway could not complete the processing of the exchange. In production mode, the title is replaced by Internal Server Error and the details are left out.

What the SQL Injection Protection Does

The sqlInjectionProtection plugin checks the URI, the query and form parameters, the body and, with inspectHeaders, the headers for SQL injection patterns. The level sets how aggressive the rules are, and onDetect decides whether a detection blocks the message or only logs a warning. A detected injection is reported with a different error. This error means that the inspection itself failed.

Common Causes

The Request URI Cannot Be Parsed

The URI contains characters that are illegal in a URI, so it cannot be parsed.

A Parameter Contains a Malformed Escape

The query string or an application/x-www-form-urlencoded body contains an invalid percent-escape, for example q=%zz. URL decoding then fails.

The Body Cannot Be Read

The client aborted the upload, or the Content-Encoding of the body cannot be decoded.

An Unexpected Exception in the Plugin

Any other exception that the sqlInjectionProtection plugin does not turn into an error response itself is reported under the same URL by Membrane's generic error handler. The detail then reads Aborting! Exception caused in … flow. and names the plugin, the request URI and the flow. Unless the exception points to your configuration or to the message, this usually indicates a bug in Membrane.

How to Fix It

Client side: send a valid URI, percent-encode parameter values correctly, and use a Content-Encoding that matches the body.
Gateway operator: check the log. The exception is logged at error level as Error inspecting … for SQL injection.
If the log shows none of these causes, report it with the stack trace on GitHub Issues.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---. The title then reads Internal Server Error, and instead of the details the response only contains a log key. Search the gateway log for this key to find the exception.

If the plugin is nested inside a request, response or abort element and throws an unexpected exception, the exception message, the stack trace and the link to this page are currently sent even in production mode. Fix the failing plugin rather than relying on production mode to hide them.