1

One of our company sites redirects all bad URLs back to the login page which is required to even access the site. Is this insecure? It feels like it may cause some weird issues as I have never seen this before or at least be bad practice. For example https://www.google.com/fndnandas would redirect to https://www.google.com instead of showing the 404 page as google does.

4
  • Why would it be insecure?
    – schroeder
    Sep 27, 2022 at 12:35
  • This blog mentions it being a bad idea and one of the examples is someone trying to see if your site can be hacked through a certain url. blog but doesn't this just amount to obfuscation?
    – Kineye
    Sep 27, 2022 at 12:39
  • Also owasp has it as a medium urgency alert called bypassing 403, which is obviously different than a 404 but isn't it the same route cause?
    – Kineye
    Sep 27, 2022 at 12:46
  • "Bypassing 403" is not what this is,.
    – schroeder
    Sep 27, 2022 at 13:12

1 Answer 1

2

I wouldn't call it bad practice or insecure, unless your login page is insecure, but then redirecting to it doesn't increase your insecurity.

What the blog is alluding to when it says:

Someone is trying whether your site can be hacked through a certain URL, that 404 is 100% the right thing to serve.

Automated scanners will see the successful page return as a type of success, meaning that the scanners will continue to scan and try different hacks, since they are all "successful".

So, it could be that an automated scanner that has been "encouraged" to keep trying might end up finding a vulnerability in your site that it might not have found if you returned 404's, but scanners are not easily discouraged. Scanning is free and easy, so there is no cost in trying all vulnerabilities, regardless of what the page returns, even a 404.

2
  • Thanks this is what I was looking for, so the idea is to potentially discourage scanners from attempting other variations of successful responses.
    – Kineye
    Sep 27, 2022 at 13:37
  • Yes, but as I said, it's little discouragement. If you look in the logs of any website, scanners will try any exploit, regardless of the target.
    – schroeder
    Sep 27, 2022 at 13:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .