1

I am looking at IDS (intrusion detection sensor) logs where some one tired to get a .css sheet through a URL. Ex: www.site.com/CSS/Main.css - which throws a CSS sheet in the form of text file.

Is this allowed for any user or something to concern ?

I don't have much knowledge on these, so any help is appreciated. couldn't paste the output here, security concerns !!!

sample:

.homemidcontainer{  width: 900px;   background: #fff;}
.homeleftcol{   float: left;    width: 225px;   background-color: #FFFFFF;  height: 470px;}
.homerightcol{  float: right;   width: 675px;   height: 470px;  background-color: #FFFFFF;}
  • 5
    You might want to start from the basics of web development. CSS simply styles the page and does not contain executable code. Requests to external CSS/JS files will appear as a GET request for those files. – limbenjamin Jan 11 '15 at 13:22
  • 2
    If the user can't read the CSS file, how do you expect his browser to render your page ? – user42178 Jan 12 '15 at 15:45
8

Yes, it is implicitly intended that clients will download CSS files and interpret it to figure out how to render a page. Whether that CSS is accessed automatically via a web browser or manually via a person does not really make any difference from a Security standpoint.

You should consider the content of a CSS file to be public information unless it requires authentication to access.

1

It is normal behavior for a browser to request the CSS files listed in a web page. You can see that for yourself using a browser on your system. If you hit Ctrl-S in a browser on a Microsoft Windows system or Command-S on an OS X system, you may see an option to save a webpage you are visiting as "Webpage, Complete", which normally produces a .htm or .html file with an associated directory with a similar name. If you look in that directory, or a subdirectory of it, you should see the CSS files for the webpage.

Your browser is normally fetching CSS files referenced in webpages to display those webpages for you. By saving a webpage as "Webpage, Complete", you have the opportunity to easily look at those files with a text editor yourself.

1

CSS is defined as Cascaded Style Sheet. It provides styling to the website. In order for the website to load according to the styling defined by the developer, CSS must be publicly setup and permitted, otherwise user couldn't view the web correctly, since they doesn't have proper authentication in accessing certain files. So, practically in all web, CSS can be accessed directly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.