3 ms·
Per the Draft RFC `security.txt` is meant to be akin to `robots.txt`, in that it's at the root of the path. So yeah, it's a bit inconsistent.
by TheSwordsman 9y ago
Per the Draft RFC `security.txt` is meant to be akin to `robots.txt`, in that it's at the root of the path.
So yeah, it's a bit inconsistent.
- jacquesm 9y agoThat is going to cause some problems with a very large percentage of webservers being configured to never allow the fetching of any dotfiles to avoid accidentally exposing stuff that wasn't meant to be in the web tree in the first place.
- raimue 9y ago/.well-known/ is defined in RFC5785 and paths under this prefix can be registered with IETF. For example, /.well-known/acme-challenge/ is used by ACME, the domain verification protocol used by Let's Encrypt. https://www.ietf.org/rfc/rfc5785.txt https://www.ietf.org/rfc/rfc5785.txt It should not be too hard to make an exception for this path in your web server configuration. Also note that URLs do not have to match the local filesystem, so you could as well use an alias to a different local path.