Check what goes out too
A successful attack often shows in the response: data leak, webshell output, defaced page. ToutWAF inspects the response before it reaches the visitor.
Data protection (DLP)
What leaves your applications is checked too: a stack trace never reaches the visitor, banners are removed, bank cards, IBANs and keys leaking in a response are spotted, masked or blocked, and your logs hold no password or token.
Where to find it in the console : Protection menu: Data leak prevention; Privacy in Reports and compliance.
What it is for
Reveal nothing through an error
A stack trace or a database error is replaced by a generic page. It is on by default.
Spot sensitive data
Bank cards, IBANs, national identifiers, API keys, private keys and long lists of e-mail addresses: logged, masked or blocked as you choose.
Logs without secrets
The values of sensitive fields (password, token, card...) are replaced by *** before being recorded.
How the response is checked
Response inspection is on by default; sensitive-data detection is chosen site by site.
The origin answers first
Your server handles the request normally; ToutWAF receives its response.
Detectors read the response
Up to 1 MiB of the response by default, looking for errors, secrets, personal data and signs of a webshell or defacement.
The action you chose
Log, mask (default) or block. The visitor receives the cleaned response, or a 502 error if you block.
What is detected
免费
Sensitive-data detection (DLP) is off by default; you switch it on per site and choose the types.
- Bank cards of 13 to 19 digits validated by the Luhn algorithm, and IBANs validated by their check digits.
- National identifiers of a known shape, API keys and secrets, private key blocks.
- More than 25 e-mail addresses in one response (adjustable threshold): a leaking list.
- The types detected by default are card, IBAN, national identifier, e-mail, API key and private key.
Errors and banners
免费
Two protections that are on by default.
- Error masking: a stack trace, or a database error returned with a 500 to 504 code, is replaced by a generic page.
- The Server, X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version and X-Generator banners are removed from the response.
Dangerous outputs
免费
Signs of a compromise already under way.
- Webshell output (on by default), directory listings, source code and source maps.
- Defacement, from keywords you set (off by default).
- A maximum response size, if you want one (unlimited by default).
Logs without passwords
免费
Events do not contain the secrets your visitors typed.
- Fields whose name is on the list (password, token, authorization, API key, card, cvv, IBAN...) are replaced by *** in the address, a form, a JSON body and a rule's excerpt.
- You add your own field names in Reports and compliance; they also apply when reading events already recorded.
- Payload capture can be switched off, and log minimisation can also drop the query string, user agent and referrer.
- Your API's responses are also classified by type of sensitive data for the API inventory, without blocking anything.
What is not done, or not proven
We prefer to say it plainly.
- Custom patterns (your own regular expressions) are not supported: the card was removed and the API refuses them. The mail gateway, under licence, does accept your own words and phrases.
- Inspection covers the first 1 MiB of a response by default; the rest is not read.
- A detection remains a detection: a false positive is possible (a number that looks like a card). Start by logging before masking or blocking.
- A field name you add also masks events already recorded when they are read, but the stored copy is not rewritten, nor are backups already made.
Use cases
An application that shows error traces
The visitor sees a generic page, your logs keep the trace so you can fix it.
An export that leaks cards
You log first, check the cases, then move to masking.
Passwords in the logs
Sensitive fields are masked before being recorded, including those you name yourself.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
版本免费 包含在所有方案中，包括两个免费方案（Free 和 Free +）Pro 及以上 付费方案：在控制台中可见，无许可证时被锁定。从 Pro 起，另有标注 Agency 或 Enterprise 的除外
- 错误屏蔽：堆栈跟踪和数据库错误绝不会到达访客免费
- 移除 Server 和 X-Powered-By 标识免费
- 泄露检测：银行卡（Luhn）、IBAN、国民身份号码、API 密钥、私钥、批量邮箱列表免费
- 对响应中的敏感数据执行记录、屏蔽或拦截免费
- 识别 Webshell 输出、网页篡改、目录列表和 source map免费
- 事件与日志：密码、令牌和卡号均被屏蔽免费
- 按名称屏蔽字段：接收事件时，地址、表单或 JSON 请求体中该字段的值会被替换为 ***免费
- 响应大小限制免费
随时都可以把高级选项恢复为默认值。付费许可证结束后会发生什么，见定价页的常见问题：48 小时宽限期、48 小时只读，之后 WAF 防护关闭，直到续订。