-4

If I use a link like this:

www.example.com/vjbvhagwi74g3577384hqujvbgp39843q9-8q24380gfbqp29-q2--2=08h49h24tt982uh3...

Will the infomation be safe?

10
  • 2
    Short answer: no
    – M'vy
    Sep 5, 2016 at 14:11
  • 4
    Security through Obscurity is never an option Sep 5, 2016 at 14:19
  • 2
    Short answer: yes, but it comes with a few risks (e.g. browser history, logs, referrers etc). Sep 5, 2016 at 14:21
  • 1
    @ScottStainton Unguessable tokens aren't obscurity, regardless if you put them in the url, a cookie or the http auth header. Sep 5, 2016 at 14:22
  • 4
    Define safe. As far as I can see, there's no access protection so if the link is leaked anyone can view the page.
    – billc.cn
    Sep 5, 2016 at 14:30

1 Answer 1

2

If you only access it over HTTPS, then TLS/SSL will protect the URL from eavesdroppers on the connection.

However, the secret URL can leak by other means. For example, if the page is HTML content and contains links or references to any external sources, then the URL will be leaked in the referer HTTP header.

Also, once the link is known it can be bookmarked, meaning there is no way to revoke access without changing the URL. If the link is posted anywhere else, it could also end up on search engines.

Finally, any directory browsing or path traversal vulnerabilities on your server could reveal the path.

Not the answer you're looking for? Browse other questions tagged .