Apigee API Proxy policy sequence

Question

What is the ideal sequence of policies that we need to apply while creating API proxy in Apigee? Following is the list of policies.

Spike Arrest
oAuth
Regular expression protection
JSON Threat protection
Request Quota

How performance will be impacted if oAuth is kept last?

Thanks in advance.

Answer 1

From a security perspective you would want to keep oAuth near the top of your policy order. This will ensure that attackers cannot leak information about your proxy without providing authentication.

From a performance perspective, a successful request will pass through each policy and so overall performance will not change due to the order.

If performance in failure detection is important to you, your best bet would be to keep failures that occur most frequently near the top of the policy order. This will ensure that failure happens faster for those requests.

Additionally, you can view the time each policy takes to run using the Trace feature.