How to mask HTTP Authorization header in ASM logs, similar to sensitive parameters?

These logs are not shipped off, they're only available via the F5 ASM log interface. However, obviously there's value in obfuscating sensitive data there - otherwise the option to do it with URI parameters and XML body wouldn't be there. I have two services protected by the ASM today - one passes credentials as XML elements, the other is RESTful and uses HTTP basic authentication. The first is protected, the latter isn't - and while I trust my network admins, they have no need to know our customer's passwords. I will open a feature request - thank you for that suggestion.

That being said, any pointers to the appropriate method for filing a feature request? Is that a support account issue, or generally handled through DevCentral?

no you have to open a support case. There you can describe the problem and you can write "feature request" or something. There is no dedicated option for feature requests.

Hello

You can't do it using ASM (v12.1.0). The feature is not available as it is for "sensitive parameter" and based on my tests it wasn't possible to do it :

1) Using "Data Guard" : Unfortunatly it masks only Credit Card numbers in request. As it is normaly used to protect "information leakage" (data in respond), this feature is enhanced and regexp detection is possible but only for response (not for requests).

2) Using ASM irules EVENTs (ASM_REQUEST_VIOLATION / ASM_REQUEST_BLOCKING / ASM_REQUEST_DONE): not possible because these events are triggered after the log is written into the database.

SOLUTION:

Option 1: you are already authenticated and you don't need this header later

From the "HTTP_REQUEST" event, simply remove the header "Authorization" (before doing so, verify that you don't need this header later because it will impact authentication with the server)

if { [HTTP::header "Authorization"] contains "Basic" } {

HTTP::header remove "Authorization"

}

Option 2: you are not authenticated yet and need this header after ASM validation

In this case you must first store the header value in a variable, remove it from the request, and inject it before the request is sent to the serverside from "HTTP_REQUEST_SEND" event.

Regards