# using private prefix for service callout policy request variable

**URL:** <https://discuss.google.dev/t/using-private-prefix-for-service-callout-policy-request-variable/584>\
**Category:** Apigee\
**Tags:** api-runtime\
**Created:** [May 25, 2018, 11:42am UTC](https://discuss.google.dev/t/using-private-prefix-for-service-callout-policy-request-variable/584 "2018-05-25T11:42:42Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [May 25, 2018, 11:42am UTC](https://discuss.google.dev/t/using-private-prefix-for-service-callout-policy-request-variable/584/1 "2018-05-25T11:42:42Z")

</div>

We are using ServiceCallout Policy in the request flow, as some of the fields in request payload contains sensitive data so using private prefix for the request to hide the contents in Trace session. But somehow the contents of private.myRequest.content is not getting hidden. Also tried masking the entire private.myRequest.content using API Call even that didn’t work. Please help.

Attached is the ServiceCallout policy that is used.

```auto
<ServiceCallout async="false" continueOnError="false" enabled="true" name="SC.ACN">
    <DisplayName>SC.ACN</DisplayName>
    <Properties/>
    <Request clearPayload="false" variable="private.myRequest">
        <Set>
            <Headers/>
            <Verb>POST</Verb>
            <Path>/acn</Path>
            <Payload contentType="application/json" variablePrefix="@" variableSuffix="#">
                {
                  	"name": "@cardholdername#",
                  	"creditcardnumber":"@private.creditcardnumber#",
                  	"addressline1":"@streetAddress1#",
                  	"addressline2":"@streetAddress2#",
                  	"city":"@city#",
                  	"state":"@stateOfResidence#",
                  	"zipcode":"@zip5#",
                }
            </Payload>
        </Set>
        <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
    </Request>
    <Response>calloutResponse</Response>
    <LocalTargetConnection>
        <Properties>
            <Property name="success.codes">2XX,3XX,500</Property>
        </Properties>
        <Path>/target/v1</Path>
    </LocalTargetConnection>
</ServiceCallout>

```

---

<div class="post-metadata">

**Author:** ![dchiesa1](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/dchiesa1/32/15641_2.png) [@dchiesa1](https://discuss.google.dev/u/dchiesa1)\
**Post date:** [May 25, 2018, 5:00pm UTC](https://discuss.google.dev/t/using-private-prefix-for-service-callout-policy-request-variable/584/2 "2018-05-25T17:00:15Z")

</div>

That sounds like a bug! Let me look into it.

Yes, confirming: it’s a bug. b/80300236

---

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [May 25, 2018, 6:10pm UTC](https://discuss.google.dev/t/using-private-prefix-for-service-callout-policy-request-variable/584/3 "2018-05-25T18:10:41Z")

</div>

Is there any quick solution (preferably without modifying code) for this?

---

<div class="post-metadata">

**Author:** ![dchiesa1](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/dchiesa1/32/15641_2.png) [@dchiesa1](https://discuss.google.dev/u/dchiesa1)\
**Post date:** [May 25, 2018, 6:14pm UTC](https://discuss.google.dev/t/using-private-prefix-for-service-callout-policy-request-variable/584/4 "2018-05-25T18:14:46Z")

</div>

I believe there is a workaround. You could omit the name for the variable completely.

like so:

```auto
<ServiceCallout name="SC.ACN">
    <DisplayName>SC.ACN</DisplayName>
    <Properties/>
    <Request clearPayload="false"> <!-- variable="private.myRequest" -->
        <Set>
            <Headers/>
            <Verb>POST</Verb>
            <Path>/acn</Path>
            <Payload contentType="application/json">
                {
                  	"name": "{cardholdername}",
                  	"creditcardnumber":"{private.creditcardnumber}",
                  	"addressline1":"{streetAddress1}",
                  	"addressline2":"{streetAddress2}",
                  	"city":"{city}",
                  	"state":"{stateOfResidence}",
                  	"zipcode":"{zip5}",
                }
            </Payload>
        </Set>
        <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
    </Request>
    <Response>calloutResponse</Response>
    <LocalTargetConnection>
        <Properties>
            <Property name="success.codes">2XX,3XX,500</Property>
        </Properties>
        <Path>/target/v1</Path>
    </LocalTargetConnection>
</ServiceCallout>

```

---

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [May 26, 2018, 5:23pm UTC](https://discuss.google.dev/t/using-private-prefix-for-service-callout-policy-request-variable/584/5 "2018-05-26T17:23:35Z")

</div>

Not possible in our case as as we need to send this request to another system (for auditing). Basically we are looking solution without modifying code (may be through management call). Actually, it was working in older version (16.x) Recently we upgraded to (non-prod env)18.x. And in production this proxy is deployed in Apigee PCI cloud. With code modification we can resolve this by removing “private.” from variable and mask that variable using Management call.

---

<div class="post-metadata">

**Author:** ![dchiesa1](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/dchiesa1/32/15641_2.png) [@dchiesa1](https://discuss.google.dev/u/dchiesa1)\
**Post date:** [May 30, 2018, 5:55pm UTC](https://discuss.google.dev/t/using-private-prefix-for-service-callout-policy-request-variable/584/6 "2018-05-30T17:55:49Z")

</div>

I see. Your workaround seems to be appropriate.

We’re treating the problem as a P1 security bug. The fix is already engineered and is being merged. Expect that fix to be rolled out in June.

---

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [June 15, 2018, 2:48pm UTC](https://discuss.google.dev/t/using-private-prefix-for-service-callout-policy-request-variable/584/7 "2018-06-15T14:48:49Z")

</div>

[@Dino-at-Google](https://community.apigee.com/users/8595/dchiesa-1.html) I’m wondering when this fix will be provided for on-prem solutions.

---

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [June 15, 2018, 4:37pm UTC](https://discuss.google.dev/t/using-private-prefix-for-service-callout-policy-request-variable/584/8 "2018-06-15T16:37:32Z")

</div>

If I’m not mistaken this workaround doesn’t work cause it just sets the variable name to null. So I see things like null.headers.Authorization or null.formparam.password

---

<div class="post-metadata">

**Author:** ![dchiesa1](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/dchiesa1/32/15641_2.png) [@dchiesa1](https://discuss.google.dev/u/dchiesa1)\
**Post date:** [June 15, 2018, 5:47pm UTC](https://discuss.google.dev/t/using-private-prefix-for-service-callout-policy-request-variable/584/9 "2018-06-15T17:47:30Z")

</div>

That may be the case, Daniel. If so, not much of a workaround.

---

<div class="post-metadata">

**Author:** ![dchiesa1](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/dchiesa1/32/15641_2.png) [@dchiesa1](https://discuss.google.dev/u/dchiesa1)\
**Post date:** [June 15, 2018, 5:48pm UTC](https://discuss.google.dev/t/using-private-prefix-for-service-callout-policy-request-variable/584/10 "2018-06-15T17:48:08Z")

</div>

We have the fix built; it’s a matter of getting a patch release out. I would guess… within a few weeks.