Usually it is advised, when one wants to secure an application, to "provide" as little information, or better yet, no information at all to unauthorized (possibly malicious) users. I'm thinking of information like OS, app version, etc.
My question is the following:
I have a web application that allows access only from specific IPs, the rest of the world gets an HTTP Forbidden response. I was wondering, in the context of security mentioned above, is there anything wrong? I mean I guess an intruder would know that an HTTP server is running but would not be able to access it.
Is there a security issue because of this? Could it be improved somehow?
I am also using authentication via username and password but if the source IP is not in the allowed list they do not get a username/password prompt page. Just forbidden