Linked Questions

20 votes
1 answer

Use of obscure URL for security [duplicate]

My hosting provider is offering an infrastructure-as-a-service (IaaS) product administered via a web interface, where the administrator can create and destroy virtual machines. To access the web-...
Anonymous Ballstein's user avatar
5 votes
3 answers

Is random URL token secure enough for file attachments and other user content? [duplicate]

Lets say we have a hypothetical system where there are various files are added by users and are sensitive, e.g. lets say an attachment to a private message. It's not that easy to verify access rights ...
Ilya Chernomordik's user avatar
1 vote
1 answer

Is it secure to have public access to the file on S3 with `secret` url? [duplicate]

For example This is a private file, I send to the web-browser through https link to that private file - but this file is ...
Vitaly Zdanevich's user avatar
0 votes
1 answer

The security of an unique URL parameter [duplicate]

Take for example a simple messaging system. Users can send each other personal messages. When reading a personal message sent to you, the URL would be something like
P.Yntema's user avatar
  • 1,047
0 votes
1 answer

Is an unknown directory structure considered security by obscurity? [duplicate]

I have a static website and it's security depends on people not knowing that a secret file is at Assuming that the path to the the file is not randomly generated, ...
jkd's user avatar
  • 119
0 votes
0 answers

HTTP Basic Authentication vs. obscure filename [duplicate]

I'm setting up a service which allows a single 3rd party to access a file over HTTPS. The only security mechanism the 3rd party supports is Basic Authentication. To reduce complexity, I was going to ...
Alastair McCormack's user avatar
134 votes
4 answers

Is it safe to include an API key in a request's URL?

Lately I've seen plenty of APIs designed like this: curl "" Isn't it elementary that passing an API key in a query string as a part of ...
Incerteza's user avatar
  • 2,257
4 votes
2 answers

S3 Bucket Name Obscurity as Security

Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. * Can I assume that a public S3 ...
David_Springfield's user avatar
0 votes
2 answers

Is Link Obscurity as a Security Practice Bad?

I have heard that "Security by Obscurity" is bad. And I have always agreed with it. But today I had a coworker disagree when in consideration of links. He was arguing that a link with ...
Vaccano's user avatar
  • 101
-4 votes
1 answer

Does using a long, un-guessable link protect a page? [closed]

If I use a link like this: Will the infomation be safe?
MetricSystemAdvocate's user avatar
0 votes
1 answer

Risks of sharing information just "protected" by a unguessable url [duplicate]

I recently started to use grafana to visualize a lot of different metrics. Grafana also enables me to share dashboard snapshots directly via a link. Which is pretty comfortable since I can share the ...
1 vote
1 answer

What are the security risks of only using an id in the url to protect the content?

I'm building a note-taking app, when a user writes a note an id is generated and I redirect them to a page where they can see its content with a URL like /note/DXSt832pS5iLuos6uxBn. What are the ...
Hugo's user avatar
  • 123