Configuring Information Leakage Prevention Rules to Protect Sensitive Information from Leakage
You can add two types of information leakage prevention rules.
- Sensitive information filtering: prevents disclosure of sensitive information, such as ID numbers, phone numbers 11-digit phone numbers registered in the Chinese Mainland, and email addresses.
- Response code interception: blocks the specified HTTP status codes.
If you have enabled enterprise projects, ensure that you have all operation permissions for the project where your WAF instance locates. Then, you can select the project from the Enterprise Project drop-down list and configure protection policies for the domain names in the project.
Prerequisites
You have added your website to a policy.
- For cloud CNAME access mode, see Connecting a Website to WAF (Cloud Mode - CNAME Access).
- For dedicated access mode, see Connecting Your Website to WAF (Dedicated Mode).
Constraints
- This function is not supported by the cloud standard edition, or the cloud load balancer access mode.
- This function is not supported by the professional edition.
- It takes several minutes for a new rule to take effect. After the rule takes effect, protection events triggered by the rule will be displayed on the Events page.
Configuring an Information Leakage Prevention Rule
- Log in to the management console.
- Click in the upper left corner of the management console and select a region or project.
- Click in the upper left corner and choose Web Application Firewall under Security & Compliance.
- In the navigation pane on the left, choose Policies.
- Click the name of the target policy to go to the protection configuration page.
- Click the Information Leakage Prevention configuration area and toggle it on or off if needed.
- : enabled.
- : disabled.
- In the upper left corner above the Information Leakage Prevention rule list, click Add Rule.
- In the dialog box displayed, add an information leakage prevention rule by referring to Table 1.
Information leakage prevention rules prevent sensitive information (such as ID numbers, phone numbers, and email addresses) from being disclosed. This type of rule can also block specified HTTP status codes.
Sensitive information filtering: Configure rules to mask sensitive information, such as phone numbers and ID numbers, from web pages. For example, you can set the following protection rules to mask sensitive information, such as ID numbers, phone numbers, and email addresses:Figure 1 Sensitive information leakage
Response code interception: An error page of a specific HTTP response code may contain sensitive information. You can configure rules to block such error pages to prevent such information from being leaked out. For example, you can set the following rule to block error pages of specified HTTP response codes 404, 502, and 503.Figure 2 Blocking response codes
- Click Confirm. The added information leakage prevention rule is displayed in the list of information leakage prevention rules.
Related Operations
- To disable a rule, click Disable in the Operation column of the rule. The default Rule Status is Enabled.
- To modify a rule, click Modify in the row containing the rule.
- To delete a rule, click Delete in the row containing the rule.
Configuration Example — Masking Sensitive Information
To verify that WAF is protecting your domain name www.example.com against an information leakage prevention rule:
- Add an information leakage prevention rule.
Figure 3 Sensitive information leakage
- Enable information leakage prevention.
Figure 4 Information Leakage Prevention configuration area
- Clear the browser cache and access http://www.example.com/admin/.
The email address, phone number, and identity number on the returned page are masked.
Figure 5 Sensitive information masked
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot