For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ramann_75062's avatar
ramann_75062
Icon for Nimbostratus rankNimbostratus
Jul 13, 2009

Disable CC data for POST requests

Hi @all,     its me again :-)     Today, i am looking for a way to deactivate the CC check only for POST requests - is this possible?     My first idea was, to do this...
app sec
BIG-IP Access Policy Manager (APM)
security
Benjamin_9036's avatar
Benjamin_9036
Historic F5 Account
Jul 15, 2009
Hey Bjoern,

 

 

You may want to double-check the source of the page that is returned. Based on the 'Context' provided in the violation report, it looks like the number might be in a 'hidden' input field.

 

The context in the report certainly seems disparate from the example you posted, so perhaps this is the disconnect. Maybe open the page, view source, and try to find the whole number or the "karteNummer" string in which we can see it in the below sample:

 

 

 

Pattern Context

 

Credit Card Number karteNummer" value="6677880000000004" />

 

 

 

 

It definitely appears that the whole card number is being sent back to the user-agent, probably as a form element. This means it won't appear on the page, but is still an element in the form that the user-agent will transmit back.

 

 

// Ben