Protect APIs With Security Headers Using Azure API Management Policies

Azure API Management policies have powerful capabilities that allow the publisher to change the behavior of the API through configuration. The API gateway; i.e. API Management, receives all requests and usually forwards them unaltered to the underlying API. However, a policy can apply changes to both the inbound request and outbound response and it may include limiting call rate, security headers, changing JSON to XML, etc.

As we know, Http security headers help to protect against some of the attacks which can be executed against WebAPI. It is always best practice to implement those headers either through the application or through API Gateway.

This article demonstrates how to implement HTTP security headers as outbound policies in Azure API Management.

I created an Azure API Management services instance and imported and published my API. In case you are not aware of how to import and publish apis into API Management, I would recommend you to check Microsoft documentation.

Before adding outbound policies into Azure API Management, let’s see what response headers are coming while calling my API using Postman.

As we can see, none of the security headers are there as part of the response. Also, it is not recommended to leak the info about a technology stack that is running on the backend e.g. X-Powered-By information in response. We can remove it easily by outbound policies.

Implementing Security Headers As Outbound Policies in API Management

Now I am adding outbound processing policies to my API (in my case api name is “CoursesAPI”) onto API management.

Select your API in API management.
On the top of the screen, select Design tab.
Select All operations.
In the Outbound processing section, click the </> icon.

Modify <outbound> tag as like below and Save.

<outbound>
<set-header name="Strict-Transport-Security" exists-action="override">
<value>max-age=31536000</value>
</set-header>
<set-header name="X-XSS-Protection" exists-action="override">
<value>1; mode=block</value>
</set-header>
<set-header name="Content-Security-Policy" exists-action="override">
<value>script-src 'self'</value>
</set-header>
<set-header name="X-Frame-Options" exists-action="override">
<value>deny</value>
</set-header>
<set-header name="X-Content-Type-Options" exists-action="override">
<value>nosniff</value>
</set-header>
<set-header name="Expect-Ct" exists-action="override">
<value>max-age=604800,enforce</value>
</set-header>
<set-header name="Cache-Control" exists-action="override">
<value>none</value>
</set-header>
<set-header name="X-Powered-By" exists-action="delete" />
<set-header name="X-AspNet-Version" exists-action="delete" />
</outbound>

Validating API Response Headers

Let’s hit the API again from Postman and check the response headers.

Excellent! Now we can see that security headers are part of the API response.

In this article, we have implemented WebAPI security headers through Azure API management outbound policies. I hope you find this article useful!