Can I prevent sensitive data (credit card, national ID number) from leaking out in the response?

Short answer

Yes, in two ways. To hide the value and send the response, the Mask type of the Modify Response Content action is used; the TC ID. NO and Credit card patterns are ready in the Built-in Mask Regexes list. If the response containing sensitive data is not to be sent at all, the HTTP Response Body condition searches for the pattern in the first part of the response body (at most 16384 bytes), and a Block or Show Content action with Execution Level On response returns an error or information page instead of the actual response. WAF does not inspect responses; this is done with Load Balancer actions.

Problem: Sensitive Data Appears in Application Responses

Because of a faulty query, an error page or a missing authorization check, a credit card or national ID number can leak out in the application response. It is wanted that this data is hidden before it reaches the client or that the response is not sent at all. Both methods are a layer of precaution; the data must be fixed at its source.

Solution: Two Methods

The two methods are alternatives to each other: one changes the response and sends it, the other does not send the response at all.

Your situation	Suitable method
The page should keep opening; only the value should be hidden	Method 1: Modify Response Content → Mask
The response containing sensitive data should not be sent at all	Method 2: HTTP Response Body + Block / Show content

Method 1: Modify Response Content → Mask Recommended

• How it works In the response body, the texts that match the Mask Query pattern are replaced with the Masking Character; the length is preserved and the response is sent to the client.
• Where it is openedLoad Balancer → Actions → Modify Response Content → Modify Type = Mask
• Requirement None
• vService type HTTP (the action works only at the response stage)

Step-by-Step Configuration

1

Adım 1 Open the action form

The action form is opened with Load Balancer → Actions → Add (how to add).

2

Adım 2 Define the masking

Action Name = tc-maske, Action Type = Modify Response Content, Modify Type = Mask are selected. Query type is left at the default RegEx; under Built-in mask regexes, TC ID. NO (or Credit card) is clicked and the pattern is added to the Mask Query field. Masking Character is left at the default *. Since the Masking Tolerance default is 1, the first and last characters of the match remain visible (12345678901 → 1*********1); if the whole value is to be hidden, 0 is entered.

3

Adım 3 Save the action

The action is saved with Add. To limit it to specific pages, a condition can be selected in the Conditions field.

4

Adım 4 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and the edit form is opened with Edit.

5

Adım 5 Add the action to the vService

tc-maske is selected in the Details → Actions field.

6

Adım 6 Save

The form is saved with Save. For the other fields (Omitted characters, Masking tolerance, Min. Occurrences for Masking) and the HTML adding / content replacing types: Can I modify the response body (e.g. inject a script into HTML, mask national ID / card numbers)?

Verification

1Masked responseClient side

The page that returns sensitive data is opened, or the output of curl -s https://www.example.com/profil is checked.

Expected1*********1

The value remains visible on the Backend Service and in the application logs; masking affects only the response that goes to the client.

Method 2: HTTP Response Body + Block / Show Content

• How it works Before forwarding the response to the client, TR7 holds it for at most 500 ms until Body Size to Parse(Bytes) bytes are collected, and the condition searches for the pattern in this part; on a match, the Block or Show content that works at the response stage takes the place of the actual response.
• Where it is openedLoad Balancer → Conditions → HTTP Response Body · Load Balancer → Actions → Block / Show Content
• Requirement The compression profile must be off on the vService (TR7 does not turn off compression automatically for this condition).
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the condition form

The condition form is opened with Load Balancer → Conditions → Add (how to add).

2

Adım 2 Define the condition

Condition Name = tc-yanit, Criteria = HTTP Response Body, and the Regex matching are selected; \b[0-9]{11}\b for the TC ID number or \b[0-9]{4}[ -]?[0-9]{4}[ -]?[0-9]{4}[ -]?[0-9]{4}\b for the card number is written in the Query field, and Body Size to Parse(Bytes) (at most 16384) is entered. The national ID pattern catches every 11-digit number (e.g. a phone number); the pattern and the scope are kept narrow.

3

Adım 3 Save the condition

The condition is saved with Add.

4

Adım 4 Open the action form

The action form is opened with Load Balancer → Actions → Add.

5

Adım 5 Define the Block action

Action Name = tc-yanit-engel, Action Type = Block, Execution Level = On Response are selected; Deny Type is left at the default Standard and Status Code = 500 is selected. If an information page is to be shown instead of an error, Show content is selected, Execution level is set to On response, and the page and the status code are selected.

6

Adım 6 Bind the condition

tc-yanit is selected in the Conditions field; to avoid scanning image and file responses, a path condition can be added with and in the same group.

7

Adım 7 Save the action

The action is saved with Add.

8

Adım 8 Edit the vService

The HTTP vService is opened with Edit.

9

Adım 9 Add the action to the vService

tc-yanit-engel is selected in the Details → Actions field. If the Compression box under Details is checked, it is unchecked.

10

Adım 10 Save

The form is saved with Save. If the Compression box was unchecked, the vService is restarted on save and open connections are briefly interrupted. In a cluster, the change is transferred to the peer device automatically by default; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1Cut responseClient side

Command: curl -s -o /dev/null -w '%{http_code}' https://www.example.com/profil

Expected500

2Normal pageClient side

A page that does not contain sensitive data is requested with the same command.

Expected200

Common Mistakes

• Thinking masking is the only protection. The data remains visible on the Backend Service and in the application logs; it must be fixed at its source.
• Searching for a pattern in a compressed response. The HTTP Response Body condition does not match reliably in compressed content; compression must be off on the vService (operational recommendations).
• Applying the condition to all responses. Image and file responses are also scanned, and each response can be held for up to 500 ms; it is narrowed with a path condition.
• Thinking WAF will inspect the response. WAF inspects requests; the response content is handled with Load Balancer actions.

How it is done in the documentation

• Modify Response Content · Built-in Mask Regexes
• Modify Response Content · Mask Mode Add Form
• HTTP Response Body · Body Size to Parse(Bytes)
• HTTP Response Body · Scenario 2: Sensitive Data Leak Detection and Blocking

Related questions

• Can I modify the response body (e.g. inject a script into HTML, mask national ID / card numbers)?
• Can I look for and block specific content in the request body (JSON / XML / form)?
• How much security does the Load Balancer module provide on its own; when do I need a WAF?