4 ms·
You're better off implementing a allowlist-approach if you wanna do path blocking (not saying that you should). Most web applications know exactly what paths ar
by capableweb 4y ago
You're better off implementing a allowlist-approach if you wanna do path blocking (not saying that you should). Most web applications know exactly what paths are possible, enable those and block everything else.
- scrollaway 4y agoThus leading to an awful experience for those who typo something in the url bar, or if someone sends a link that gets slightly mangled.
- nibbleshifter 4y agoThose end up at a static 404 anyway, right?
- capableweb 4y agoHow so? Serve a 404 page like you normally would, no need to return a 403 or whatever.
- scrollaway 4y agoSo what is it exact you’re suggesting in your original post? GP was asking about fail2ban and you suggested an allowlist… Serving a 404 is what would happen by default.
- e1g 4y ago+1 to this, and use a URL prefix that’s unique to your app,so instead of “/api” and “/static” you have such as “/xyapi” and “/xystatic”. That alone will cut down noise 99% and what’s left is probably a targeted scan/attack.
- Eduard 4y agoSounds futile to do for GET parameters.