Can I modify the response body (e.g. inject a script into HTML, mask national ID / card numbers)?

Short answer

Yes, with the Modify Response Content action on the HTTP vService. Modify Type = Mask masks values such as national ID or card numbers in the response (ready patterns can be selected with Built-in Mask Regexes); Add HTML Code adds code to the selected HTML Tag (html, head, body, title); Replace replaces the found text with New Content. The action is applied only to responses returning from the Backend Service and does not look at the content type; for this reason, it is used with an HTTP Header (Response) condition that looks at the Content-Type of the response. On the vService where the action is present, an uncompressed response is requested from the Backend Service and response compression is disabled.

Problem: The Response Contains Content That Must Be Changed

Personal data may appear in plain view in application responses, an analytics or tracking code may need to be added to all pages, or old links may need to be fixed. When the application cannot be changed, these modifications are made while the response passes through TR7.

Solution: Three Methods

The three methods are the three Modify Type options of the same action; more than one Modify Response Content can be added to the same vService, and the actions are chained in order. The common prerequisite in all of them is the condition that selects only HTML responses:

Common condition	Value
Criteria	HTTP Header
Header Name	Content-Type from the Response group
Matching	Includes, value text/html

Without this condition, JSON, JavaScript and binary (image, PDF) responses are also processed; in a binary file, matching byte sequences may change and the file may be corrupted.

Your situation	Suitable method
Masking personal data	Method 1: Mask
Adding a script or HTML to pages	Method 2: Add HTML Code
Replacing a text with another text	Method 3: Replace

Method 1: Mask Recommended

• How it works The characters of every value that matches the pattern are replaced with the masking character; the length of the text is preserved. As many characters as the tolerance at the start and the end, as well as the characters in Omitted characters, can be left visible.
• Where it is openedLoad Balancer → Actions → Modify Response Content → Mask
• Requirement Content-Type condition
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Content-Type condition form

Load Balancer → Conditions → Add is clicked (how to add).

2

Adım 2 Define the condition

Criteria = HTTP Header; Header Name = Response Content-Type; matching Includes, value text/html.

3

Adım 3 Save the condition

Add is clicked.

4

Adım 4 Open the action form

Load Balancer → Actions → Add is clicked (how to add).

5

Adım 5 Select the pattern

Action Name is entered, and Action Type = Modify response content and Modify Type = Mask are selected. In the Built-in Mask Regexes row, TC ID. NO or Credit card is clicked; with Query Type = RegEx (default), Mask Query is filled: \b\d{11}\b for TC ID. NO, \b((\d{16})|((\d{4}-){3}\d{4})|((\d{4}\s){3}\d{4}))\b for Credit card. Case Sensitive is off by default (the search is case-insensitive).

6

Adım 6 Configure the masking

• Masking Character: default *.
• Masking Tolerance: default 1; this many characters stay visible at the start and the end of the match (if the match is longer than twice the tolerance).
• Min. Occurrences for Masking: default 1; the match from which masking starts.
• Omitted Characters: characters that are not masked; for the separators in the card number to stay visible, - and a space are written.

7

Adım 7 Select the condition

The condition from step 2 is selected in the Conditions field.

8

Adım 8 Save the action

Add is clicked.

9

Adım 9 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

10

Adım 10 Add the action to the Actions field

The action is selected in the Details → Actions field.

11

Adım 11 Save

Save is clicked. In a cluster, the change is also sent to the peer device with the default auto-sync (with Synchronize if Manual Sync Mode is on).

Results of the ready patterns on sample texts (tolerance 1):

Text	Pattern	Result
TCKN: 12345678901	TC ID. NO	TCKN: 1*********1
Tel: 05551234567	TC ID. NO	Tel: 0*********7 (every 11-digit number is masked)
No: 123456789012	TC ID. NO	Unchanged (12 digits)
Kart: 4111111111111111	Credit card	Kart: 4**************1
Kart: 4111-1111-1111-1111	Credit card	Kart: 4*****************1; with Omitted characters -, Kart: 4***-****-****-***1
Kart: 4111 1111 1111 1111	Credit card	Kart: 4*****************1
Kart: 4111-1111 1111-1111	Credit card	Unchanged (mixed separators)
IBAN TR12 0006 1005 1978 6457 8413 26	Credit card	IBAN TR12 0*****************7 8413 26 (four groups of four digits are taken for a card)

While Min. Occurrences for Masking = 2, the text TC: 12345678901, Tel: 05551234567 becomes TC: 12345678901, Tel: 0*********7.

Verification

1ResponseClient side

curl -sk https://www.example.com/profil | grep -oE '[0-9*]{11}' or the page source in the browser

Expected1*********1

2CompressionClient side

curl -skI -H "Accept-Encoding: gzip" https://www.example.com/profil

ExpectedNo Content-Encoding header

Method 2: Add HTML Code

• How it works The HTML code is added right after the opening (Append) or right before the closing (Prepend) of the selected tag.
• Where it is openedLoad Balancer → Actions → Modify Response Content → Add HTML Code
• Requirement Content-Type condition
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Prepare the Content-Type condition

If the condition does not exist, it is created with steps 1–3 of Method 1.

2

Adım 2 Open the action form

Load Balancer → Actions → Add is clicked.

3

Adım 3 Select the tag and the position

Action Name is entered, and Action Type = Modify Response Content and Modify Type = Add HTML Code are selected. HTML Tag = body, Tag Modify Type = Prepend (the code is added right before </body>). For scripts, head + Prepend can also be used. When Append is selected, the code is added after every opening tag whose name starts with the selected tag; head + Append also adds code to the <header> elements on the page.

4

Adım 4 Write the code

The HTML Content to Add field comes filled with a sample script that converts the http:// links on the page to https://; it is replaced with the code to be added.

5

Adım 5 Select the condition

The Content-Type condition is selected in the Conditions field.

6

Adım 6 Save the action

Add is clicked.

7

Adım 7 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

8

Adım 8 Add the action to the Actions field

The action is selected in the Details → Actions field.

9

Adım 9 Save

Save is clicked.

Results of the positions on a sample page ([KOD] is the added content):

Selection	Result
body + Prepend	…<header class="ust">Menü</header>[KOD]</body>
head + Prepend	<head><title>x</title>[KOD]</head>
head + Append	<head>[KOD]<title>… and <header class="ust">[KOD]Menü</header>

Verification

1ResponseClient side

curl -sk https://www.example.com/ | grep -B1 '</body>' or the page source in the browser

ExpectedThe added code right before the </body> line

Method 3: Replace

• How it works Every content found with a text (String) or a pattern (RegEx) is replaced with New content; the length of the text may change.
• Where it is openedLoad Balancer → Actions → Modify Response Content → Replace
• Requirement Content-Type condition
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Prepare the Content-Type condition

If the condition does not exist, it is created with steps 1–3 of Method 1.

2

Adım 2 Open the action form

Load Balancer → Actions → Add is clicked.

3

Adım 3 Write the searched and the new text

Action Name is entered, and Action Type = Modify Response Content and Modify Type = Replace are selected. Query Type = String, Mask Query = http://cdn.example.com/, New Content = https://cdn.example.com/. The String search is case-sensitive; if RegEx is selected, Case sensitive is off by default. New content is added as plain text; group references such as \1 are not resolved.

4

Adım 4 Select the condition

The Content-Type condition is selected in the Conditions field.

5

Adım 5 Save the action

Add is clicked.

6

Adım 6 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

7

Adım 7 Add the action to the Actions field

The action is selected in the Details → Actions field.

8

Adım 8 Save

Save is clicked.

Verification

1ResponseClient side

curl -sk https://www.example.com/ | grep -c 'http://cdn.example.com/'

Expected0

Common Mistakes

Compression is turned off on the entire vService

As long as the action is on the vService, an uncompressed response is requested from the Backend Service in all requests, regardless of the condition; the Compression profile on the vService also has no effect. Bandwidth and response time increase; the action is used only on vServices that need content changes.

• Not adding a Content-Type condition. The action does not look at the content type; without a condition, JSON, CSS and binary responses are also processed.
• Assuming that the ready patterns catch only the target data. The TC ID. NO pattern masks every 11-digit number (e.g. a phone number), and the Credit card pattern masks four groups of four digits (e.g. part of an IBAN); the result is tested on sample pages.
• Using a group reference in Replace. New content is plain text; \1 comes out as written.
• Adding a script with head + Append. The code is also added to <header> elements; Prepend is used with body or head.
• Counting masking as the only protection. Masking changes the response while it goes to the client; the data stays in plain form on the Backend Service.
• Looking for the mixed content fix here. For link problems in the switch to HTTPS: After switching to HTTPS, pages show a "mixed content" warning; how do I fix it?

How it is done in the documentation

• Modify Response Content · What Is the Modify Response Content Action?
• Modify Response Content · Scenario 1: Mask Mode: Masking the TC ID Number for KVKK Compliance
• Modify Response Content · Masking Tolerance
• Modify Response Content · Tag Modify Type

Related questions

• Can I add, remove or change HTTP Headers in a request or response?
• After switching to HTTPS, pages show a "mixed content" warning; how do I fix it?
• Can I change a header value with a regex?