PII Leak Guardian: A Gateway-Based Approach for Detecting Sensitive Data Exposure in Web Applications

Abstract

The leak of sensitive data is one of the most critical security threats to web applications. APIs and backend services are mainly responsible for holding sensitive information such as personal identity details (PII) including e-mails, phone numbers, authentication tokens, and financial data. The exposure of such data to clients can be a result of misconfigured systems, incorrectly formatted API responses, or even the developer's mistakes leading to the unintentional availability of this information, hence privacy breaches and security risks. This paper, in the first place, presents PII Leak Guardian which is a security tool that supervises the data flow and stops any leakage of sensitive data instantly through HTTP responses. Operating on the client-server path, it is a reverse proxy. It collects outgoing responses and conducts pattern-based searching for data types which are usually regarded as sensitive such as phone numbers, email addresses, credit card details, API keys, and authentication tokens. It then has the ability to either mask or remove such data automatically prior to the response being dispatched to the user. We have developed the system in Python using the FastAPI framework and run the tests on the OWASP Juice Shop which is a purposely vulnerable web application for security testing. The results indicate that the system is capable of identifying different types of sensitive data without significantly increasing the processing time. This means that the security layer introduced is very much straightforward and easy to deploy enhancing data protection without requiring any changes in existing applications.