: Why am I seeing "*QUERYSTRINGPII_REMOVED*" in the query string of a lot of requests I regularly see URIs like the following that contain *QUERYSTRINGPII_REMOVED* and the IDS blows them away without

@Pierce454

Posted in: #DataUri #ModSecurity

I regularly see URIs like the following that contain *QUERYSTRINGPII_REMOVED* and the IDS blows them away without further examination. I could just allow the asterisk character but it isn't legitimate for any of our pages. Is there some software people have on their machine that is perhaps redacting what it sees as credit card numbers or otherwise sensitive info? A Google search shows this on quite a few places, not just my site.

GET /Private/Info/SomePage?ItemID=a23458575d2&*QUERYSTRINGPII_REMOVED* HTTP/1.1

Vote Up Vote Down

Login to post a comment!