I'm having a discussion with devs as we build out a web app which involves users, user generated content, an admin area, api and static content.
Anyone is able to access the majority of template information such as the user account template where users would view and update their information, the template url requires very little digging to find and no authentication to request. Same goes for the majority of administration templates, none of which will function correctly without the correct authentication but it's still accessible for reading.
This allows anyone (authenticated users especially) to gain a solid understanding of how the web app and API's function. Preventing access to this information would only provide a layer of obscurity as the API methods and internal functions would still operate the same - people would just have to make more assumptions.
Currently our reasonings are,
Yes we should prevent access: Only provide resources as required, anything more will encourage malicious behaviour.
No we shouldn't prevent access: It's a lot of extra work, it adds complexity and if we have a security issue this would only provide obscurity.
So my question is:
should we (and do others) prevent access to this type of non-sensitive information?
After further discussion, someone suggested this nightmarish policy:
graphical resources, such as the sign-out icon, should only be available to authenticated users and origins which are expected to display the icon.