[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-25。"],[[["\u003cp\u003eThis page details how to configure Google Cloud Armor to parse POST body content, an optional feature that can help avoid false positives with preconfigured Web Application Firewall (WAF) rules.\u003c/p\u003e\n"],["\u003cp\u003eEnabling alternative parsing for supported content types like JSON is recommended for workloads that serve REST APIs, use GraphQL, or receive JSON-encoded requests to minimize noise and the risk of false positives.\u003c/p\u003e\n"],["\u003cp\u003eJSON body content parsing can be enabled or disabled per security policy using the \u003ccode\u003e--json-parsing\u003c/code\u003e flag in the Google Cloud CLI, supporting \u003ccode\u003eSTANDARD\u003c/code\u003e, \u003ccode\u003eSTANDARD_WITH_GRAPHQL\u003c/code\u003e, and \u003ccode\u003eDISABLED\u003c/code\u003e options.\u003c/p\u003e\n"],["\u003cp\u003eWhen configuring JSON parsing, you can specify custom \u003ccode\u003eContent-Type\u003c/code\u003e header values for alternative parsing and set the policy to include GraphQL parsing with \u003ccode\u003eSTANDARD_WITH_GRAPHQL\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe inspection of POST body content is limited to the first 8 KB, and if the JSON parser fails to produce a result, URI parsing may be attempted.\u003c/p\u003e\n"]]],[],null,["# Request body content parsing\n\nThis page contains information about configuring request body content parsing, an\noptional feature that you can use with your Cloud Armor security\npolicies.\n\nBy default, Cloud Armor evaluates the full content of a request body as a\nuniform string (subject to [body size limitations](#limitations))\nagainst the signatures in your preconfigured WAF rules. For requests that\ncontain alternative encoding like JSON, structural components of the message\n(not user specified) can trigger matches against the preconfigured WAF\nsignatures. To avoid noise and reduce the risk of false positives, we recommend\nthat you configure Cloud Armor to enable alternative parsing for any\nsupported content type if your protected workloads do the following:\n\n- Serve REST APIs\n- Use GraphQL\n- Receive any requests with JSON encoded content.\n\nFor each security policy, you can enable or disable JSON parsing for request\nbodies. When the `Content-Type` header is set to\n`application/json`, use the `--json-parsing` flag in the Google Cloud CLI.\n\nBy default, this option is disabled. The syntax for the flag follows:\n\n`--json-parsing=[STANDARD | STANDARD_WITH_GRAPHQL | DISABLED]`\n\nThe flag is available only with `gcloud compute security-policies update`. You\ncannot create a new security policy with this option unless you create a\nsecurity policy in a file and then import that file. For more information, see\n[Import security policies](/armor/docs/configure-security-policies#importing-policies).\n\nUse JSON parsing\n----------------\n\nIn the following example, you configure a list of custom `Content-Type` header\nvalues for which alternative parsing is applied. The example updates the\nsecurity policy \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e to enable JSON parsing, and specifies the\ncontent types `application/json`, `application/vnd.api+json`,\n`application/vnd.collection+json`, and `application/vnd.hyper+json`: \n\n```\ngcloud compute security-policies update POLICY_NAME \\\n --json-parsing STANDARD \\\n --json-custom-content-types \"application/json,application/vnd.api+json,application/vnd.collection+json,application/vnd.hyper+json\"\n```\n\nUse GraphQL parsing\n-------------------\n\nTo configure GraphQL parsing, update your security policy to set the\n`--json-parsing` flag to `STANDARD_WITH_GRAPHQL`: \n\n```\ngcloud compute security-policies update POLICY_NAME \\\n --json-parsing STANDARD_WITH_GRAPHQL\n```\n\nLogging\n-------\n\nEach HTTP(S) request that is evaluated against a Cloud Armor security\npolicy is logged through Cloud Logging. The logs provide details, such as the\nname of the applied security policy, the matching rule, and whether the rule was\nenforced. Request logging for new backend service resources is disabled by\ndefault. To log Cloud Armor requests, you must enable the HTTP(S)\nlogging setting for each backend service protected by a security policy.\n\nFor more information, see\n[Global external Application Load Balancer logging and monitoring](/load-balancing/docs/https/https-logging-monitoring).\n\n\nLimitations\n-----------\n\nConsider the following limitations when configuring JSON parsing:\n\n- Cloud Armor inspects the `HTTP POST` body up to the first 8 kB by default. You can configure this limit to either 8 kB,\n 16 kB, 32 kB, 48 kB, or 64 kB. If the JSON content is larger than the\n configured inspection limit, then Cloud Armor applies JSON parsing\n up to this limit, which is then inspected by any of the preconfigured WAF rules.\n\n For more information about configuring the inspection limit for the request\n body when using preconfigured WAF rules, see\n [POST and PATCH body inspection limitation](/armor/docs/security-policy-overview#post-body).\n- If the JSON parser returns no result, URI parsing might be attempted. If the\n URI parser returns no name-value parameters or only partial\n name-value parameters, the entire or partial string might be treated as the\n parameter name for the inspection.\n\nWhat's next\n-----------\n\n- [Configure Cloud Armor security policies](/armor/docs/configure-security-policies)\n- [Use request logging](/armor/docs/request-logging)"]]
