-
Notifications
You must be signed in to change notification settings - Fork 57
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Potential security concern on '?asset=' #41
Comments
They are just not contents from file system. I think the auth should just protect the file system files and dirs. And maybe not all dirs need auth. Dirs that don't require auth should still be accessed by guest, who will also use that assets resources. |
I understand and agree if considering guests users. But I wrote this because i just received 2 attacks on the server, (I paste the log of the URLs tried, i hope it's not too long), may be someone knows this kind of attack or can identify some other possible vulnerability :) Quite all replies were 401 Forbidden, except those 3 'asset=' URLs. 2024-05-08 01:41:09 152.32.210.129:38978 401 GET / |
I noted that, even if i enable auth 'everywhere', the
/?asset=index.js
/?asset=index.css
/?asset=favicon.ico
are working without giving a Forbidden 401 error.
May be it would be 'more secure' to include all replies into the general authentication process?
Why are they excluded now?
The text was updated successfully, but these errors were encountered: