Help Center/ Web Application Firewall/ User Guide (Paris) / Dedicated WAF Mode/ Policies/ Configuring Data Masking Rules to Prevent Privacy Information Leakage
Updated on 2024-03-14 GMT+08:00
View PDF
Share

Configuring Data Masking Rules to Prevent Privacy Information Leakage

This topic describes how to configure data masking rules. You can configure data masking rules to prevent sensitive data such as passwords from being displayed in event logs.

If you have enabled enterprise projects, ensure that you have all operation permissions for the project where your WAF instance locates. Then, you can select the project from the Enterprise Project drop-down list and configure protection policies for the domain names in the project.

Prerequisites

You have added your website to a policy.

Constraints

It takes several minutes for a new rule to take effect. After the rule takes effect, protection events triggered by the rule will be displayed on the Events page.

Impact on the System

Sensitive data in the events will be masked to protect your website visitor's privacy.

Procedure

  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. Click in the upper left corner and choose Web Application Firewall (Dedicated) under Security.
  4. In the navigation pane on the left, choose Policies.
  5. Click the name of the target policy to go to the protection configuration page.
  6. In the Data Masking configuration area, change Status if needed and click Customize Rule.
  7. In the upper left corner above the Data Masking rule list, click Add Rule.
  8. In the displayed dialog box, specify the parameters described in Table 1.

    Table 1 Rule parameters

    Parameter

    Description

    Example Value

    Path

    Part of the URL that does not include the domain name.

    • Prefix match: The path ending with * indicates that the path is used as a prefix. For example, if the path to be protected is /admin/test.php or /adminabc, set Path to /admin*.
    • Exact match: The path to be entered must match the path to be protected. If the path to be protected is /admin, set Path to /admin.
    NOTE:
    • The path supports prefix and exact matches only and does not support regular expressions.
    • The path cannot contain two or more consecutive slashes. For example, ///admin. If you enter ///admin, WAF converts /// to /.

    /admin/login.php

    For example, if the URL to be protected is http://www.example.com/admin/login.php, set Path to /admin/login.php.

    Masked Field
    A field set to be masked
    • Params: A request parameter
    • Cookie: A small piece of data to identify web visitors
    • Header: A user-defined HTTP header
    • Form: A form parameter
    • If Masked Field is Params and Field Name is id, content that matches id is masked.
    • If Masked Field is Cookie and Field Name is name, content that matches name is masked.

    Field Name

    Set the parameter based on Masked Field. The masked field will not be displayed in logs.

    NOTICE:

    The length of a subfield cannot exceed 2,048 bytes. Only digits, letters, underscores (_), and hyphens (-) are allowed.

    Rule Description

    A brief description of the rule. This parameter is optional.

    None

  9. Click Confirm. The added data masking rule is displayed in the list of data masking rules.

Related Operations

  • To disable a rule, click Disable in the Operation column of the rule. The default Rule Status is Enabled.
  • To modify a rule, click Modify in the row containing the rule.
  • To delete a rule, click Delete in the row containing the rule.
Parent topic: Policies