This question already has an answer here:

I am developing a web app which currently does not have authentication/authorization mechanism. But I still want to add an admin url from which I can add content. The admin url is not revealed to users and is hard to guess (a url like /mysupersecretadmin) but it does not have any authentication. So anyone who has the url, can post stuff to the app.The app uses https exclusively. I'm wondering how insecure is this practice?

marked as duplicate by schroeder Sep 1 '17 at 11:56

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • There's only one answer to this and that's "very!" – Jeroen Sep 1 '17 at 11:52
  • what you described is called "security by obscurity" - if you search that term here, you will find that it has been answered multiple times – schroeder Sep 1 '17 at 11:52
  • 3
    it's as secure as keeping your key under your doormat - as soon as someone knows where it is (or looks for it), there is no security anymore - there is no graceful failure, it's all or nothing – schroeder Sep 1 '17 at 11:54
  • 1
    Whatever web application container you are running this webapp in, has some basic authentication features built-in. Well, literally it is called Basic Authentication. At a minimum, please learn how to enable basic auth and require basic auth to that admin URL. That wouldn't be great security, but if the sensitivity of the page is such that you are pondering no real security then basic auth is likely appropriate. – Thomas Carlisle Sep 1 '17 at 12:54
  • 1
    Why don't you try it? Use some tools that look for this kind of thing and see if you can discover it. Read this post for some ideas on how to start security.stackexchange.com/questions/39930/… – iainpb Sep 1 '17 at 13:09