Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I have a website that is only accessible by authenticating at a login page, is it possible for a non-authenticated person to get access to static assets (images, css, javascript, ...)?

I imagine the only way they could do it would be to brute force the urls somehow or somehow know where the resources on the server are located already, but I'm not sure.

share|improve this question

It depends on server configuration. If you configure the site to have the user authenticate with the server itself, then you can have the server use the users permissions and they will only be able to access resources that the user has access to and you can deny them to non-authenticated users.

If the authentication is instead a session level authentication that is implemented in a scripting language like PHP or such, then the server won't know if the assets should be provided and it would be up to your scripts to decide what to serve. If the static resources are only protected by the URL being unknown, then they could still be accessed with the latter approach.

share|improve this answer
Good answer. Just like to add that some web servers such IIS7 can protect against static resources automatically in integrated pipeline mode:… – SilverlightFox Aug 19 '13 at 9:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.