Layer7 API Management

A user can inject code in an url to our forum. The discussion board uses iframes and the following exposes a thread:

https://10.10.10.1/forum#!https://10.10.10.20:8080

Not knowing up front each possible endpoint url because of the dynamic nature or a forum, what is the best way to prevent these injections?

Hello,

How about parsing the POST data and removing URLs in them before posting to your forum?
CA API Gateway can decode the received POST data, parse and edit the forms, encode the POST data again, and POST them to the forum.

Isn't it what you're looking for?

Cheers.

You may also use regex assertion to validate the url, using special chars #!

for example, you may use a regular expression like this,

(.*)#!(.*)