Is letting just anybody see the appearance/html/javascript of your admin pages a security risk?

Question

Ok so consider the scenario in which you have two projects, one is a RESTful API, and the other is a public facing website.

The API uses cookie/token based authentication, and contains all of the logic of your application.

The website is built using a client-side MV* technology, what it can and cannot do is based on the role of the user authenticated by the API.

Hosting the HTML/JS/CSS of the website without introducing a third MVC framework is faster (and cheaper).

For example, you can have your RESTful API (maybe built with Django), and a server serving up HTML/JS/CSS as-is (let's say it's Apache), or a RESTful API and have the website itself using a server side MVC technology (such as .net MVC) which restricts access to the HTML/CSS/JS based on the user role provided by the API.

This will slow things down, but is it more secure? Is it worth the overhead to not allow somebody traversing through your publically available client side code to not be able to see how your admin pages look and what API endpoints they call and how they call them, or is this security through obscurity?

Surely a determined attacker could figure this out anyway by using a tool like fiddler while browsing your public pages and then analyse your API with another tool?

Thanks

Answer 1

I wouldn't worry about it. Imagine it like this: if you use, say, django.contrib.admin, everyone knows what the admin pages look like. Is that a security risk? Not if requests are being properly authenticated and authorized.

You might want to take care that the pages themselves do not expose information you'd rather keep secret or would be useful in social engineering, such as "to reset a user's password, call the internal help desk at 212-555-4240."

Answer 2

what David said, plus

• make sure noone can traversal/browse your folder with static-content, either through an empty index.html inside of each folder or

  # apache
  
  <Directory /path/to/stuff>
    Options -Indexes
  
  </Directory>
  
  # nginx
  server {
    ... 
    autoindex off;
    ...
  
  }
  

sidenote / rant:

when serving static content in a distributed environment i'd always prefer nginx over apache for pure performance-reasons; it is way (order of magnitudes) more faster while keeping a very low memory/cpu - footprint when under load. if you dont believe it, make some perf-tests with simple files and get impressed :)

if you operate such a multi-tier/server - setup i really recommend to get into such new reverse-proxy-servers, might it be nginx, varnish or ha-proxy (they all differ by their scope of operation)