1

I am looking at IDS (intrusion detection sensor) logs where some one tired to get a .css sheet through a URL. Ex: www.site.com/CSS/Main.css - which throws a CSS sheet in the form of text file.

Is this allowed for any user or something to concern ?

I don't have much knowledge on these, so any help is appreciated. couldn't paste the output here, security concerns !!!

sample:

.homemidcontainer{  width: 900px;   background: #fff;}
.homeleftcol{   float: left;    width: 225px;   background-color: #FFFFFF;  height: 470px;}
.homerightcol{  float: right;   width: 675px;   height: 470px;  background-color: #FFFFFF;}
Improve this question
2
  • 5
    You might want to start from the basics of web development. CSS simply styles the page and does not contain executable code. Requests to external CSS/JS files will appear as a GET request for those files.
    – limbenjamin
    Jan 11, 2015 at 13:22
  • 2
    If the user can't read the CSS file, how do you expect his browser to render your page ?
    – user42178
    Jan 12, 2015 at 15:45

3 Answers 3

Reset to default
8

Yes, it is implicitly intended that clients will download CSS files and interpret it to figure out how to render a page. Whether that CSS is accessed automatically via a web browser or manually via a person does not really make any difference from a Security standpoint.

You should consider the content of a CSS file to be public information unless it requires authentication to access.

Improve this answer
1

It is normal behavior for a browser to request the CSS files listed in a web page. You can see that for yourself using a browser on your system. If you hit Ctrl-S in a browser on a Microsoft Windows system or Command-S on an OS X system, you may see an option to save a webpage you are visiting as "Webpage, Complete", which normally produces a .htm or .html file with an associated directory with a similar name. If you look in that directory, or a subdirectory of it, you should see the CSS files for the webpage.

Your browser is normally fetching CSS files referenced in webpages to display those webpages for you. By saving a webpage as "Webpage, Complete", you have the opportunity to easily look at those files with a text editor yourself.

Improve this answer
1

CSS is defined as Cascaded Style Sheet. It provides styling to the website. In order for the website to load according to the styling defined by the developer, CSS must be publicly setup and permitted, otherwise user couldn't view the web correctly, since they doesn't have proper authentication in accessing certain files. So, practically in all web, CSS can be accessed directly.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .