Web application response cloaking

A computer readable storage device comprising a computer program for execution by at least one processor to:

• receive, by a proxy, a first request sent from a Web client to request data from a Web application;
• send, by the proxy, the first request to the Web application;
• receive, by the proxy, response data from the Web application that is responsive to the first request sent from the Web client, wherein the proxy monitors requests and responses between the Web client and the Web application;
• identify, by the proxy, application data in the response data that will also be included as part of a second, different request that will be subsequently sent from the Web client to the Web application, wherein the identified application data comprises only a subset of the response data;
• modify, by the proxy, the response data to cloak only the identified application data using a cloak algorithm to form cloaked application data configured to pass through a security filter without rejection by the security filter, wherein the proxy communicatively couples the Web application to the security filter, and wherein the cloak algorithm implements character exchange logic to transform one or more characters of the identified application data into one or more other characters or sequences;
• send the cloaked application data from the proxy to the Web client via the security filter;
• subsequent to sending the cloaked application data from the proxy to the Web client, receive, by the proxy, the second request comprising the cloaked application data from the Web client via the security filter, wherein the second request is distinct from both the response data and from the first request;
• revert, by the proxy, the cloaked application data of the second request to a pre-cloak state using an uncloak algorithm, wherein the uncloak algorithm is a reverse operation of the cloak algorithm that was previously used to cloak the identified application data of the response data that was previously received from the Web application, and wherein the uncloak algorithm transforms the one or more other characters or sequences of the cloaked application data back into the one or more characters;
• and
• send the reverted application data comprising the one or more characters from the proxy to the Web application.

A proxy device, comprising:

• at least one processor;
• at least one computer readable storage media;
• and
• one or more program modules stored on the at least one computer readable storage media,
• wherein the one or more program modules are executable by the at least one processor to:
• receive a first request sent from a Web client to request data from a Web application;
• send the first request to the Web application;
• receive response data from the Web application that is responsive to the first request sent from the Web client, wherein the proxy device monitors requests and responses between the Web client and the Web application;
• identify application data in the response data that will also be included as part of a second, different request that will be subsequently sent from the Web client to the Web application, wherein the identified application data comprises only a subset of the response data;
• modify the response data to cloak only the identified application data using a cloak algorithm to form cloaked application data configured to pass through a security filter without rejection by the security filter, wherein the proxy device communicatively couples the Web application to the security filter, and wherein the cloak algorithm implements character exchange logic to transform one or more characters of the identified application data into one or more other characters or sequences;
• send the cloaked application data to the Web client via the security filter;
• subsequent to sending the cloaked application data to the Web client, receive the second request comprising the cloaked application data from the Web client via the security filter, wherein the second request is distinct from both the response data and from the first request;
• revert the cloaked application data of the second request to a pre-cloak state using an uncloak algorithm, wherein the uncloak algorithm is a reverse operation of the cloak algorithm that was previously used to cloak the identified application data of the response data that was previously received from the Web application, and wherein the uncloak algorithm transforms the one or more other characters or sequences of the cloaked application data back into the one or more characters;
• and
• send the reverted application data comprising the one or more characters to the Web application.