I work on a web application which has an array of static assets like button images and css files, every time a request comes in for one of these assets forms security has to check that the request is valid.
I understand that it's important to protect user's data and the source code but is there any benefit to checking the user's authorisation when they are requesting files that any signed in user would be able to access?
Static assets like JS, CSS and Images those are already in public domain need not to be authenticated requests. By making it authenticated you are putting extra load on the server and restrictions on using CDN and Cache servers which will negatively impact the performance.
If these files are dynamically generated to serve differently for each signed in user or it contains user specific details like a JS data or a profile picture then it should be requested with authentication. Also, You can remove the authencation here by making the file names for such assets hard to guess.
No.If the resource requested by a user isn't unique from user to user or anything remotely sensitive in manner,there is no point in putting authorisation constraints over it.
checking the user's authorisation when they are requesting files that any signed in user would be able to access?
Then only check if they are signed in or not,but IF the resource can be requested by anyone either signed in or not,then no point in checking it at least from a security perspective.I cant comment on performance you will have to see that one for yourself
