Forum Discussion

Narendren_S's avatar
Narendren_S
Icon for Nimbostratus rankNimbostratus
Nov 03, 2018

Client Side Sensitive Parameter Encryption

Hi All, We have set some of the parameters as sensitive for the login pages and confirmed all those sensitive parameters values are masked in the ASM Logs.

 

Query: Whether the ASM Sensitive Parameter feature will mask the sensitive parameter values only in the ASM Logs? (Verified the parameter values at Client Browser, Proxy(Fiddler) and confirmed sensitive parameters values are not encrypted)

 

If ASM Sensitive Parameter and Websafe Credential Protection are different features, please suggest alternate options like irule to enable sensitive parameter encryption at client side. Note: BigIP is licensed with ASM and LTM.

 

ASM Advanced WAF
fraud protection
security
WebSafe

1 Reply

Sort By
  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Nov 03, 2018

    ASM only protects the server side (requests which made it from user's browser to F5). If a user types a password/credit card in their browsers and doesn't click Submit button there is no way ASM can protect it as this password has not reached ASM yet.

     

    If you want to protect the client side from man-in-the-browser malware you need WebSafe and Advanced WAF