A researcher recently reported an issue in a site about using script on a 3rd party site to discover if a user is an admin.
Here's the scenario:
- Main site is target.example
- Attacker site is evil.example
- target.example has SSL and HSTS and redirects all http traffic to https using a 301 redirect
- the session cookie on target.example is httponly and "secure"
This technique leverages the fact that the site returns a 403 instead of a 200 on admin pages. The suggestion was to return a 200 error on admin pages for logged out users instead of returning the 403 error.
The risk presented by returning a 403 or 404 is that the attacker will only send attacks for users they know are admins. This would let the attacker fingerprint the site or attempt to exploit it and the only "noise" in the logs would be higher than normal number of 403 errors in the error log which might not raise suspicion as much as other kinds of activity might.
The question: Does it actually add practical security benefit to return a 200? Is this a thing that many sites do?