If I use a link like this:
www.example.com/vjbvhagwi74g3577384hqujvbgp39843q9-8q24380gfbqp29-q2--2=08h49h24tt982uh3...
Will the infomation be safe?
Asked
Active
Viewed 275 times
-4
Anders
- 64,406
- 24
- 178
- 215
MetricSystemAdvocate
- 103
- 2
-
2Short answer: no – M'vy Sep 05 '16 at 14:11
-
4Security through Obscurity is never an option – Scott Stainton Sep 05 '16 at 14:19
-
2Short answer: yes, but it comes with a few risks (e.g. browser history, logs, referrers etc). – CodesInChaos Sep 05 '16 at 14:21
-
1@ScottStainton Unguessable tokens aren't obscurity, regardless if you put them in the url, a cookie or the http auth header. – CodesInChaos Sep 05 '16 at 14:22
-
@CodesInChaos I didn't read properly! I thought it was just a random hyperlink - not a token – Scott Stainton Sep 05 '16 at 14:25
-
4Define safe. As far as I can see, there's no access protection so if the link is leaked anyone can view the page. – billc.cn Sep 05 '16 at 14:30
-
http://security.stackexchange.com/questions/89108/is-a-website-published-in-an-obscure-directory-comparably-secure-to-being-placed – Anders Sep 06 '16 at 07:59
-
http://security.stackexchange.com/questions/58215/are-random-urls-a-safe-way-to-protect-profile-photos – Anders Sep 06 '16 at 07:59
-
http://security.stackexchange.com/questions/91837/use-of-obscure-url-for-security – Anders Sep 06 '16 at 07:59
-
http://security.stackexchange.com/questions/36870/is-including-a-secret-guid-in-an-url-security-through-obscurity – Anders Sep 06 '16 at 07:59
1 Answers
2
If you only access it over HTTPS, then TLS/SSL will protect the URL from eavesdroppers on the connection.
However, the secret URL can leak by other means. For example, if the page is HTML content and contains links or references to any external sources, then the URL will be leaked in the referer HTTP header.
Also, once the link is known it can be bookmarked, meaning there is no way to revoke access without changing the URL. If the link is posted anywhere else, it could also end up on search engines.
Finally, any directory browsing or path traversal vulnerabilities on your server could reveal the path.
SilverlightFox
- 33,408
- 6
- 67
- 178