2

I have a WordPress blog, and when I navigate to a particular path such as http://example.com/wp-content/themes/css/jquery-scrollbar.css?, I could see all the CSS code for the scroll bar.

My questions are:

  1. Is this a normal behaviour or is it a vulnerability?

  2. How to prevent the browser from showing the CSS?

  3. Is known CSS code a vulnerability?

Improve this question
1
  • 5
    I see there are a lot of downvotes here. I'm upvoting it because the user has a genuine question about security that's very easy to answer, even if he or she has a lot of misconceptions. We are all here to learn more about infosec...
    – Mark Buffalo
    Commented Mar 3, 2016 at 15:28

3 Answers 3

Reset to default
13

Everything that is executed in the browser can be seen by the client, that is the nature of the Web. This includes HTML, javascript, and CSS. So, unless you put something confidential in a file that will be served by your browser, this is not an a vulnerability.

Edit: below is from @schroeder's comment

In addition, every single webpage can show the CSS code. You can download the CSS files, or open developer view to see and even manipulate the CSS code for your browser.

Improve this answer
1
  • 1
    In addition, every single webpage can show the CSS code. You can download the CSS files, or open developer view to see and even manipulate the CSS code for your browser.
    – schroeder ♦
    Commented Mar 3, 2016 at 7:36
5

Welcome to Security.SE. The issue that you described is not a security vulnerability. The reason is that JavaScript and CSS files must be viewable by the browser so that your website can function normally.

Improve this answer
0
-2

This is completely normal for a webpage without explicit security, it's even possible to copy a whole website if you have access to a bash terminal. The only real way to ensure no one has access to directories or files is to use a .htaccess file. These dictate which directories the user can view and not. For example, if you add an entry for www.foo.com/css then I head there, it'll return a 403.

Hope this helps.

Improve this answer
2
  • 1
    CSS must be visible to the user as it is evaluated in the browser. If you protect CSS, then the site won't display correctly.
    – Neil Smithline
    Commented Mar 4, 2016 at 3:38
  • @NeilSmithline I'm talking about directory access, when the user navigates to it manually
    – TechnicalTophat
    Commented Mar 4, 2016 at 9:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .