News for hackers. Stuff that matters.

A comment on Blog post id enumeration can lead to unwanted information disclosure.

Re:Blog post id enumeration can lead to unwanted information... by kolinko on Monday February 29, 2016 @12:44AM (#11193790)
It's not the redirects that shouldn't happen. It's that if the content isn't yet published, it should not be available.

There are other ways unpublished urls may leak in - for example via sitemaps. Trying to lock them all down is lousy engineering. Instead just password protect the unpublished content and you're done.

[ Parent | on HN ]
Re:Blog post id enumeration can lead to unwanted information... by djhn on Monday February 29, 2016 @02:12AM (#11194026)
Content metadata can be revealing, I reckon that's why the urls in the article say [redacted]. The title of the post gives away information. Even financially significant info in the case of announcements, for instance.
[ Parent | on HN ]