KB: 00001011

Masking login credentials for applications that are behind Haltdos WAF.

Problem Statement

The client requires to mask the login credentials. This means that wehn any user is logging in, the login credentials can be accessed via access logs. Hence, Haltdos WAF needs to ensure masking of sensitive information / Login credentials for the websites that are behind WAF.

Solution

1. Go to Listener --> Profile --> Rules --> Log Rules

2. Create a new Log rule

   1. Enter rule name and rule message along with rule priority.

   2. Enter URI (PCRE Regex) - to filter URI

   3. Enter Method

3. Adding attributes to be masked.

   1. Add location

   2. Mention parameter

   3. Enter match condition and value

   4. Add attribute

4. Repeat step 3 for multiple attributes.

5. Save changes.

Log rule details

As per entered log rule details, the password should be hidden with Asterisk (*) sign

JSON format of Access log

As passwords can be extracted from the access log, but after deploying log rules in WAF, the password value is masked with Asterisk sign (*).