I have heard that I should (A) use one URL for all "pages" on my site, such that what page is shown is determined by the session state, and (B) don't use an extension like .php. One curious fellow even claimed (C) in a talk that people should not return 200 codes but should use randomly chosen codes.

I guess I understand B and C as these confuse would-be attackers who are running Nikto or Skipfish or whatever.

What are the reasons for doing the solo endpoint? It could be a lot of work to convert my PHP4 code to use only one endpoint since I have maybe 40 PHP files. I would've thought that attackers would have more trouble dealing with many URLs, one per PHP file.

  • 2
    What is the "logic" behind C and breaking the http status codes the web server sends out? – Fiasco Labs Feb 8 '15 at 7:13
  • Wouldn't this "solo endpoint" have side effects regarding search engines and accessibility (browser's bookmark and 'previous' button for instance)? – WhiteWinterWolf Feb 8 '15 at 8:34
  • If I were you, I would probably be more worried about my site being hacked through MAC and IP address. – Question Overflow Feb 8 '15 at 9:37
  • 2
    None of the above, as security through absurdity doesn't work. – Michael Hampton Feb 8 '15 at 10:05
  • @FiascoLabs There's a defcon talk about this. It turns out that randomizing the status codes confuses Nikto and Skipfish but it doesn't confuse browsers. I suppose that won't last forever though.... – Icann Feb 8 '15 at 16:55

If these were propositions made in the context of information security, then they all would be examples of security through obscurity. From the Wikipedia article linked:

In security engineering, security through obscurity is the use of secrecy of design or implementation to provide security. Security through obscurity is discouraged and not recommended by standards bodies. A system relying on security through obscurity may have theoretical or actual security vulnerabilities, but its owners or designers believe that if the flaws are not known, then attackers will be unlikely to find them. A system may use security through obscurity as a defense in depth measure; while all known security vulnerabilities would be mitigated through other measures, public disclosure of products and versions in use makes them early targets for newly discovered vulnerabilities in those products and versions. An attacker's first step is usually information gathering; this step is delayed by security through obscurity. The technique stands in contrast with security by design and open security, although many real-world projects include elements of all strategies.

Security through obscurity has never achieved engineering acceptance as an approach to securing a system, as it contradicts the principle of simplicity. The National Institute of Standards and Technology (NIST) in the United States specifically recommends against this practice: "System security should not depend on the secrecy of the implementation or its components."

Generally speaking, it is a very poor approach to reasoning about a system's security. I do not see any security benefits that might be yielded by employing just one single endpoint, nor would omitting file extensions enhance the security of your web service. There may or may not exist benefits of omission in the realm of search engine optimization (SEO), and I think that may have been what was meant originally. I see even less SEO benefits for the one-page website, however, as pointed out by @Fiasco Labs. I don't market myself as an SEO guru (consult your local Digital Point forums).

The idea of using just a single endpoint may have spawned from today's increasingly common practice of delegating logic and routing to the client side while only serving out one page with static dependencies, and otherwise just performing session-authenticated database/long-term state operations in response to user interaction (see Meteor). Might the recommendation of omitting ".php" also have just been spawned from one person's distaste for that language in particular? I was not there.

  • 3
    Those three measures are more like security theatre than security through obscurity! – Question Overflow Feb 8 '15 at 9:42
  • The idea with omitting .php is that if attackers don't know what language you're using, they can't as easily assess what vulnerabilities exist that are language specific e.g. it may turn out that a function commonly used in PHP is buggy in version x.y.z and the creepy guys at Hacking Team know this. – Icann Feb 8 '15 at 16:59
  • Also it's worth pointing out that although it's true security through obscurity should not be the first line of defense, the huge number of attacks coming from criminals and governments (NIST is a part of a govt hint hint), necessitates taking any steps possible to slow them down. Who doesn't want to slow down attackers? Attackers of course (criminals & govts). – Icann Feb 8 '15 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.