Oracle® Fusion Middleware
Part 6. Monitoring and reporting

<HTTPRedactor>
   <HTTPURL value="/payment"/>
   <HTTPParam value="credit_card"/>
   <HTTPParam value="password"/>
   <HTTPHeader value="Authorization"/>
</HTTPRedactor>

Each HTTPURL value is used to match URL paths, and to determine if the redaction applies to the transaction. You can use the match attribute to specify a match for an exact URL path or for a URL prefix. The following example shows an exact URL path match:

<HTTPURL value="/secure_folder" match="exact"/>

In this exact match example:

The following example shows a URL prefix match:

<HTTPURL value="/creditcard/" match="prefix"/>

In this prefix match example:

HTTPURL values are also case sensitive. For example:

<HTTPURL value="/order/shiptoaddress"/>

This is different from:

<HTTPURL value="/ORDER/shiptoaddress"/>

HTTP features such as the following are supported:

This section shows an end-to-end example of redacting an HTTP Basic authorization header. Given the following HTTP request message:

GET /securefiles/ HTTP/1.1
Host: www.httpwatch.com
Authorization: Basic aHR0cHdhdGNoOmY=

And the following HTTP redactor configuration:

<HTTPRedactor>
   <HTTPURL value="/securefiles/" match="exact"/>
   <HTTPHeader value="Authorization"/>
</HTTPRedactor>

The HTTP message is redacted and stored in the traffic monitoring database as follows:

GET /securefiles/ HTTP/1.1
Host: www.httpwatch.com

rule = path_seg [“.”path_seg]*
path_seg = wildcard/rel_wildcard/identifier/array_elem
array_elem = identifier ”[”wildcard/number“]”
identifier = char*
wildcard = “*”
rel_wildcard = “**”

a.b.c, a.*.c, a.**.c, **.b.c,**.b[0].c,**.b[*].c, *.b[0].*

<JSONRedactor>
   <RedactMime mimeType="text/json"/>
   ...
   <JSONPath path="a.b.c"/>
   <JSONPath path="**.b[0].c"/>
</JSONRedactor>

The following shows a simple example from redaction.xml:

<JSONRedactor>
   <RedactMime mimeType="application/json"/>
   <JSONPath path="**.subject[0].id"/>
</JSONRedactor>

This example removes JSON content such as the following:

authentication.subject[0].id
cert.subject[0].id
attribute.subject[0].id

This section shows an end-to-end example of redacting an OAuth message token. Given the following JSON request message:

{
   "access_token":"2YotnFZFEjr1zCsicMWpAA",
   "token_type":"example",
   "expires_in":3600,
   "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
   "example_parameter":"example_value"
 }

And the following JSON redactor configuration:

<JSONRedactor>
    <RedactMime mimeType="application/json"/>
    <JSONPath path="**.access_token"/>
    <JSONPath path="**.refresh_token"/>     
</JSONRedactor>

The JSON message is redacted and stored in the traffic monitoring database as follows:

{
   "access_token":null,
   "token_type":"example",
   "expires_in":3600,
   "refresh_token":null,  
   "example_parameter":"example_value"
 }

<XMLRedactedElement localname=”sensitive_data” namespace=”http://oracle.com”
  redactionDisposition=”redactChildren”/>

The following example from redaction.xml removes all children from a_namespace:a_name. It also removes the an_attribute_name and another_attribute_name attributes:

<XMLRedactor>
   <RedactMime mimeType="application/xml"/>
   <RedactMime mimeType="text/xml"/>
   <!--Remove children of a_namespace:a_name and some attributtes-->
    <XMLRedactedElement localname="a_name" namespace="a_namespace" 
     redactionDisposition="redactChildren">
     <XMLRedactedAttribute localname="an_attribute_name" namespace="an_attribute_namespace"/>
     <XMLRedactedAttribute localname="another_attribute_name" namespace="o"/>
    </XMLRedactedElement>
</XMLRedactor>

The following example removes the b:a element and all its children:

<XMLRedactor>
   <RedactMime mimeType="application/xml"/>
   <RedactMime mimeType="text/xml"/>   
   <!---Remove element b:a and all its descendants-->
   <XMLRedactedElement localname="a" namespace="b" redactionDisposition="redactElement"/>
</XMLRedactor>

This section shows an end-to-end example of redacting a WS-Security username token. Given the following XML request message:

<?xml version="1.0" encoding="UTF-8"?>
<Envelope xmlns="http://www.w3.org/2003/05/soap-envelope">
 <Header>
  <Security xmlns="http://docs.oasis-open.org/wss/2004/01/
     oasis-200401-wss-wssecurity-secext-1.0.xsd">
    <UsernameToken>
      <Username>root</Username>
      <Password Type="http://docs.oasis-open.org/wss/2004/01/
        oasis-200401-wss-username-token-profile-1.0#PasswordDigest">EVfkjdkljla=</Password>
      <Nonce>tKUH8ab3Rokm4t6IAlgcdg9yaEw=</Nonce>
      <Created xmlns="http://docs.oasis-open.org/wss/2004/01/
        oasis-200401-wss-wssecurity-utility-1.0.xsd">2010-08-10T10:52:42Z</Created>
    </UsernameToken>
  </Security>
 </Header>
 <Body>
   <SomeRequest xmlns="http://example.ns.com/foo/bar" />
 </Body>
</Envelope>

And the following XML redactor configuration:

<XMLRedactor>
   <RedactMime mimeType="text/xml" />
   <XMLRedactedElement localname="UsernameToken" 
      namespace="http://docs.oasis-open.org/wss/2004/01/
        oasis-200401-wss-wssecurity-secext-1.0.xsd"
      redactionDisposition="redactChildren">
   </XMLRedactedElement>
</XMLRedactor>

The XML message is redacted and stored in the traffic monitoring database as follows:

<?xml version="1.0" encoding="UTF-8"?>
<Envelope xmlns="http://www.w3.org/2003/05/soap-envelope">
 <Header>
  <Security xmlns="http://docs.oasis-open.org/wss/2004/01/
    oasis-200401-wss-wssecurity-secext-1.0.xsd">
    <UsernameToken></UsernameToken>
  </Security>
 </Header>
  <Body>
    <SomeRequest xmlns="http://example.ns.com/foo/bar" />
  </Body>
</Envelope>

<RawRedactor>
   <RedactMime mimeType="text/plain"/>
   <Regex exp="creditcard\s*=\s*(\d*{16})" redact="1" icase="true"/>
   <Regex exp="source:\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b" redact="1,2" icase="true"/>
   <Regex exp="\d*{16}" redact="0" icase="false" />
</RawRedactor>

This section shows some configured regular expressions and the behavior with specific raw message content. The following expression specifies to redact a defined group:

<Regex exp="creditcard\s*=\s*(\d{16})" redact="1" icase="false"/>

The following shows example message content and the behavior with this expression:

The following expression specifies to redact multiple defined groups:

<Regex exp="ccdigits:(\d{1,4})\.(\d{1,4})\.(\d{1,4})\.(\d{1,4})" redact="1,2,3" 
icase="false"/>

The following shows example message content and the behavior with this expression:

The following expression specifies to redact content using case insensitivity:

<Regex exp="credit\s*card\s*\d{16}" redact="0" icase="true/>

The following shows example message content and the behavior with this expression: