Why does Membrane API Gateway block my request as SQL injection?

The sqlInjectionProtection plugin found a pattern from the OWASP Core Rule Set in the path, a query parameter, a form field, a JSON value or the body. Requests are blocked with 400, responses with 502.

How do I reduce false positives of the SQL injection protection?

Use level 1, keep inspectHeaders off, and set onDetect to warn while tuning, so that hits are only logged. The log line names the rule ID and the location of the hit.

How do I hide the details in Membrane error responses?

Enable production mode by adding a configuration document with production: true to your apis.yaml. Membrane then leaves out detailed information from error responses.

SQL Injection Blocked

Membrane API Gateway links to this page when the sqlInjectionProtection plugin finds a SQL injection pattern in a message and blocks it. The detection rules are derived from the OWASP Core Rule Set.

The Error Response

The response contains the problem type https://membrane-api.io/problems/security, a link to this page and the header X-Protection: Content violates SQL injection security policy. The type security means that a security plugin blocked the message. The status depends on the flow:

400 Bad Request: In the Request Flow

The request of the client contains content that matches a rule. The request does not reach the backend.

502 Bad Gateway: In the Response Flow

The response of the backend contains content that matches a rule, for example a SQL error message. The client receives this error instead of the response. In production mode, the title of this 502 is replaced by Internal Server Error.

What the Plugin Inspects

The plugin checks the path, query parameters, form fields, JSON values and text bodies, and optionally headers. level selects the paranoia level from 1 to 4: higher levels enable more rules and cause more false positives.

api:
  port: 2000
  flow:
    - limit:
        maxBodyLength: 100000
    - sqlInjectionProtection:
        level: 1
  target:
    url: https://api.predic8.de

api:
  port: 2000
  flow:
    - limit:
        maxBodyLength: 100000
    - sqlInjectionProtection:
        level: 1
  target:
    url: https://api.predic8.de

Common Causes

An Injection Attempt

A parameter or body contains SQL fragments such as ' OR 1=1 --. This is what the plugin is designed to block.

A False Positive

Legitimate content looks like SQL to the rules, for example free text with quotes and keywords like select or union. False positives are more likely at higher levels.

Header Inspection Is Enabled

With inspectHeaders: true, headers such as User-Agent or Referer can match a rule.

The Backend Response Matches a Rule

In the response flow, content returned by the backend matches a rule.

How to Fix It

Look for the info-level log line Blocked SQL injection (rule ...). It names the rule ID and the location of the hit.
Client: do not send SQL fragments in parameters or bodies. If the content is legitimate, contact the API owner.
Operator: to reduce false positives, use level: 1 and leave inspectHeaders off.
Operator: while you tune the configuration, set onDetect: warn so that hits are only logged.
Operator: to check only requests, place the plugin inside a request flow.

api:
  port: 2000
  flow:
    - sqlInjectionProtection:
        level: 1
        onDetect: warn
  target:
    url: https://api.predic8.de

api:
  port: 2000
  flow:
    - sqlInjectionProtection:
        level: 1
        onDetect: warn
  target:
    url: https://api.predic8.de

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---.