For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Selvac_323353's avatar
Selvac_323353
Icon for Nimbostratus rankNimbostratus
Jun 07, 2017

Unscrubbing credit card numbers

We have a scenario, where credit card scrubbing is done in response payload using iRule and the masked numbers are sent to UI. From UI next request goes to application to get card transaction detail....
ASM Advanced WAF
iRules
security
Leonardo_Souza's avatar
Leonardo_Souza
Icon for Cirrocumulus rankCirrocumulus
Jun 07, 2017

If the next request comes in the same connection, you save the data in the first request and then use that data in the next request. Basically, first http_request event you save the credit card number in a variable. Next http_request event from the same connection, you will have access to that same variable.

 

The other way of doing would be saving that to the session table, with a ID. You could then query the table for that ID after, and you don't need to request in the same connection. However, if you get that wrong, you charge the wrong customer. :/

 

For this option see this:

 

https://devcentral.f5.com/wiki/irules.table.ashx

 

By the way, you could do similar work with the ASM data guard (mask the data), is just cheaper with an iRule. :P