Check what goes out too
A successful attack often shows in the response: data leak, webshell output, defaced page. ToutWAF inspects the response before it reaches the visitor.
Data protection (DLP)
What leaves your applications is checked too: a stack trace never reaches the visitor, banners are removed, bank cards, IBANs and keys leaking in a response are spotted, masked or blocked, and your logs hold no password or token.
Where to find it in the console : Protection menu: Data leak prevention; Privacy in Reports and compliance.
What it is for
Reveal nothing through an error
A stack trace or a database error is replaced by a generic page. It is on by default.
Spot sensitive data
Bank cards, IBANs, national identifiers, API keys, private keys and long lists of e-mail addresses: logged, masked or blocked as you choose.
Logs without secrets
The values of sensitive fields (password, token, card...) are replaced by *** before being recorded.
How the response is checked
Response inspection is on by default; sensitive-data detection is chosen site by site.
The origin answers first
Your server handles the request normally; ToutWAF receives its response.
Detectors read the response
Up to 1 MiB of the response by default, looking for errors, secrets, personal data and signs of a webshell or defacement.
The action you chose
Log, mask (default) or block. The visitor receives the cleaned response, or a 502 error if you block.
What is detected
Gratis
Sensitive-data detection (DLP) is off by default; you switch it on per site and choose the types.
- Bank cards of 13 to 19 digits validated by the Luhn algorithm, and IBANs validated by their check digits.
- National identifiers of a known shape, API keys and secrets, private key blocks.
- More than 25 e-mail addresses in one response (adjustable threshold): a leaking list.
- The types detected by default are card, IBAN, national identifier, e-mail, API key and private key.
Errors and banners
Gratis
Two protections that are on by default.
- Error masking: a stack trace, or a database error returned with a 500 to 504 code, is replaced by a generic page.
- The Server, X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version and X-Generator banners are removed from the response.
Dangerous outputs
Gratis
Signs of a compromise already under way.
- Webshell output (on by default), directory listings, source code and source maps.
- Defacement, from keywords you set (off by default).
- A maximum response size, if you want one (unlimited by default).
Logs without passwords
Gratis
Events do not contain the secrets your visitors typed.
- Fields whose name is on the list (password, token, authorization, API key, card, cvv, IBAN...) are replaced by *** in the address, a form, a JSON body and a rule's excerpt.
- You add your own field names in Reports and compliance; they also apply when reading events already recorded.
- Payload capture can be switched off, and log minimisation can also drop the query string, user agent and referrer.
- Your API's responses are also classified by type of sensitive data for the API inventory, without blocking anything.
What is not done, or not proven
We prefer to say it plainly.
- Custom patterns (your own regular expressions) are not supported: the card was removed and the API refuses them. The mail gateway, under licence, does accept your own words and phrases.
- Inspection covers the first 1 MiB of a response by default; the rest is not read.
- A detection remains a detection: a false positive is possible (a number that looks like a card). Start by logging before masking or blocking.
- A field name you add also masks events already recorded when they are read, but the stored copy is not rewritten, nor are backups already made.
Use cases
An application that shows error traces
The visitor sees a generic page, your logs keep the trace so you can fix it.
An export that leaks cards
You log first, check the cases, then move to masking.
Passwords in the logs
Sensitive fields are masked before being recorded, including those you name yourself.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditieGratis Inbegrepen in alle aanbiedingen, ook in de twee gratis (Free en Free +)Pro en hoger Betaalde aanbiedingen: zichtbaar in de console, vergrendeld zonder licentie. Vanaf Pro, tenzij Agency of Enterprise staat vermeld
- Foutmaskering: een stacktrace of databasefout bereikt de bezoeker nooitGratis
- Server- en X-Powered-By-banners verwijderdGratis
- Lekdetectie: betaalkaarten (Luhn), IBAN, nationale ID's, API-sleutels, privésleutels, massale e-maillijstenGratis
- Gevoelige gegevens in antwoorden loggen, maskeren of blokkerenGratis
- Webshell-uitvoer, defacement, directorylistings en source maps worden herkendGratis
- Gebeurtenissen en logs: wachtwoorden, tokens en kaartnummers gemaskeerdGratis
- Velden die u op naam maskeert: de waarde wordt bij ontvangst van de gebeurtenis vervangen door ***, in het adres, een formulier of een JSON-bodyGratis
- Groottelimiet voor antwoordenGratis
Terugkeren naar de standaardwaarde van een geavanceerde optie is altijd mogelijk. Wat er aan het einde van een betaalde licentie gebeurt, staat in de veelgestelde vragen over de prijzen: 48 uur coulance, 48 uur alleen-lezen, daarna staat de WAF-bescherming uit tot de verlenging.
Prijzen Read the documentation
Zet vandaag nog een schild voor uw applicaties
Installeer het op uw eigen server, of neem contact met ons op om over licenties te praten.