Forum Discussion

Selvac_323353's avatar
Selvac_323353
Icon for Nimbostratus rankNimbostratus
Jun 07, 2017

Unscrubbing credit card numbers

We have a scenario, where credit card scrubbing is done in response payload using iRule and the masked numbers are sent to UI. From UI next request goes to application to get card transaction detail. During this request, can F5 restore the complete credit card number(which was previously masked by F5 during earlier response) in the request data?. Is there a way to handle this scenario?

 

Appreciate your help regarding this.

 

ASM Advanced WAF
iRules
security
  • Leonardo_Souza's avatar
    Leonardo_Souza
    Icon for Cirrocumulus rankCirrocumulus
    Jun 07, 2017

    If the next request comes in the same connection, you save the data in the first request and then use that data in the next request. Basically, first http_request event you save the credit card number in a variable. Next http_request event from the same connection, you will have access to that same variable.

     

    The other way of doing would be saving that to the session table, with a ID. You could then query the table for that ID after, and you don't need to request in the same connection. However, if you get that wrong, you charge the wrong customer. :/

     

    For this option see this:

     

    https://devcentral.f5.com/wiki/irules.table.ashx

     

    By the way, you could do similar work with the ASM data guard (mask the data), is just cheaper with an iRule. :P