I regularly see URIs like the following that contain *QUERYSTRINGPII_REMOVED* and the IDS blows them away without further examination. I could just allow the asterisk character but it isn't legitimate for any of our pages. Is there some software people have on their machine that is perhaps redacting what it sees as credit card numbers or otherwise sensitive info? A Google search shows this on quite a few places, not just my site.

GET /Private/Info/SomePage?ItemID=a23458575d2&*QUERYSTRINGPII_REMOVED* HTTP/1.1
  • "allow the asterisk character" - what do you mean by this? Is your system currently rejecting (by the IDS?) these URLs because they contain an asterisk in the query string? What part of the query string has actually been removed? – MrWhite May 17 '17 at 21:57
  • I think they he means that because they are not part of the "ItemID" parameter, his webserver does not pay attention to them. – Stephen Ostermiller May 18 '17 at 8:36
  • Is there a referrer logged with these requests? If these URLs are indexed in Google, does Google Search Console list them and tell you where they are linked? – Stephen Ostermiller May 18 '17 at 8:39
  • The "PII" in that stands for "Personally Identifiable Information". – Stephen Ostermiller May 18 '17 at 8:41
  • Is it possible that there is sometimes a parameter like email=foo@example.com on the URL in that place? – Stephen Ostermiller May 18 '17 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.