Forum Discussion
securityninja_2
Nimbostratus
NimbostratusASM Data Guard using custom pattern to mask sensitive data in HTTP-request header
I would like to use ASM Data Guard custom pattern to mask sensitive data that captured in http request header. The data that i want to mask is username and password within the http-request post Header.
I want to mask following data __Requesttokanverification=nmsjfueotueihvbnxikwhjslkqjsdfgjhiertjdfgjkk&Username=joe&Password=test
I've written following Reg pattern it doesn't work __Requesttokenverification=\w+\w+\w+&Username=\w+\d+&Password=\w+\d+
Amine_KadimiMVP
Data Guard is for masking server responses: https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-11-5-0/9.html
And since request parameters such as username and password need to be passed to the server, I assume that you want to mask them only in F5 logs. To do that, simply add the relevant parameters to the policy parameters list and make sure you check the case "Sensitive Parameter".