Staff

Technical Tip: Masking sensitive application information without back-end modification

Forum|Forum|2 months ago
March 23, 2026
0 replies
76 views

Description

This article describes how to mask misconfigured sensitive information in the HTML body without modifying the back-end server using FortiWeb. Examples are: application used, application version, internal file path, etc.

Scope

FortiWeb.

Solution

An application on the back-end server may contain sensitive data (in this case, an application version and file path will be used as an example):

app version example.png

In this example, there are 2 type of elements that contain sensitive data: A test string on the HTML body and the path of the file within the HTML body. Follow these steps to mask both elements from the FortiWeb:

For the path of the file: Go to Web Protection -> Advanced Protection -> URL Encryption, select the tab 'URL Encryption Rule' and then 'Create New'.
Configure the rule to match the URL displayed on the HTML body.
Go to the 'URL Encryption Policy' tab and select 'Create New'. Assign the URL Encryption rule that was just created.

URL encryption rule configuration example.png

For the text string: Go to Application Delivery -> URL Rewriting, select the 'URL Rewriting Rule' tab and then 'Create New'.
Configure the rule to match the text string displayed on the HTML body.
Go to the 'URL Rewriting Policy' tab and select 'Create New'. Assign the URL Rewriting rule that was created in the previous step.

URL rewrite rule configuration example.png

To apply both features: Go to Policy -> Web Protection Profile and either create a new profile or edit an existing 'user defined' profile. Apply both policies from URL Rewriting and URL Encryption.
Go to Policy -> Server Policy and apply the Web Protection Profile to the server policy.

WPP part 1.png