Masking request.querystring

[nmarkevich]

Hi,

I am interested in how data masking works in Apigee Edge.

Recently I noticed that masking request.querystring is not working as expected - Apigee only masks querystring of Request to target server, but the initial Request from client appears unmasked

But according to the documentation, origin of the request is a Request from client, so I suppose that such behaviour is a misleading and doesn't fit the documentation

[dchiesa1]

Hi

I haven't looked closely at this, but you may also need to mask message.querystring, and a bunch of other related variables that allow people to see the query string. This includes request.uri, message.uri, request.queryparam.PARAMNAME, and a bunch of other variants. 

But what problem are you trying to solve? I understand you're experimenting with data masking and would like to understand how it works. But I think your effort to obscure the request URL may be doomed.  It's generally considered to be a bad idea to pass secrets in the URL, either as path segments or as query parameters. The reason is that most systems log these URLs, in their entirety. Apigee does so. That URL will be logged. Even if you can persuade the datamasking thing to obscure the queryparam in a debug session, the URL will still be visible in other places.  

So. What problem are you trying to solve, really?  It's possible we might be able to tell you how to mask the queryparams for the debug session, but will that provide the security you aim for?  I think if you want the data to be secure you might consider passing it in a header or a payload.

[nmarkevich]

Hi @dchiesa1,

Thanks for your reply.

It's clear for me that passing sensitive data as query or path parameters is really bad 😞

But in my case, redesign API in order to move path and query params to safe place is not an option for now. So I would like to slightly reduce risk of disclosure and hide sensitive data at least in debug mode.

I have tried to mask the following (simultaneously): request.uri, request.url, request.querystring. But without luck - queryparams still visible in Request from Client