I'm just wondering.. Are public,visible paths/folder structures mean security risk for a website? For example, as you can see our folder structure and file names are clearly visible in our ajax calls. This code is public because it's in a javascript file.

    type: 'POST',
    url: '/controllers/ajax/ajax_front_password_reset.php',
    success: function (response) 
    {    ...  }

Is it worth masking/hiding these paths? Can someone do something harmful with these types of information? For example: call the PHP page with false/harmful data or extract source files from this folder? (Front & Server side token matching is implemented, but I'm worried a bit )

  • In your case it's important to prevent directory listings, for example with apache server you can have a look to the property "Options -Indexes". – Nico Jun 2 '19 at 15:21