For example, one of my APIs is:

Post request: /api/v0/login body:


I want to secure this API with NAXSI, but I could not find anywhere to config NAXSI to accept JSON in body (it supposes that there is SQL injection code in the body).


Try disabling the following rules from naxsi_core.rules:

  • id:1001 (double quotes)
  • id:1015 (comma)

That should work :)

  • Hi Manuel, welcome to the site! It's really great you're helping out the asked - I figured I'd mention that adding a bit of detail regarding why the above fixes the issue, as well as any resourced the asker can use to learn more about the problem would turn this into an even better, rockstar answer! – Cowthulhu Jun 4 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.