2

I have a WordPress blog, and when I navigate to a particular path such as http://example.com/wp-content/themes/css/jquery-scrollbar.css?, I could see all the CSS code for the scroll bar.

My questions are:

  1. Is this a normal behaviour or is it a vulnerability?

  2. How to prevent the browser from showing the CSS?

  3. Is known CSS code a vulnerability?

  • 5
    I see there are a lot of downvotes here. I'm upvoting it because the user has a genuine question about security that's very easy to answer, even if he or she has a lot of misconceptions. We are all here to learn more about infosec... – Mark Buffalo Mar 3 '16 at 15:28
13

Everything that is executed in the browser can be seen by the client, that is the nature of the Web. This includes HTML, javascript, and CSS. So, unless you put something confidential in a file that will be served by your browser, this is not an a vulnerability.

Edit: below is from @schroeder's comment

In addition, every single webpage can show the CSS code. You can download the CSS files, or open developer view to see and even manipulate the CSS code for your browser.

  • 1
    In addition, every single webpage can show the CSS code. You can download the CSS files, or open developer view to see and even manipulate the CSS code for your browser. – schroeder Mar 3 '16 at 7:36
5

Welcome to Security.SE. The issue that you described is not a security vulnerability. The reason is that JavaScript and CSS files must be viewable by the browser so that your website can function normally.

-2

This is completely normal for a webpage without explicit security, it's even possible to copy a whole website if you have access to a bash terminal. The only real way to ensure no one has access to directories or files is to use a .htaccess file. These dictate which directories the user can view and not. For example, if you add an entry for www.foo.com/css then I head there, it'll return a 403.

Hope this helps.

  • 1
    CSS must be visible to the user as it is evaluated in the browser. If you protect CSS, then the site won't display correctly. – Neil Smithline Mar 4 '16 at 3:38
  • @NeilSmithline I'm talking about directory access, when the user navigates to it manually – TechnicalTophat Mar 4 '16 at 9:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.