4 ms·
The fact that it ends in `.php` is not inspiring confidence. It's 2022, it's so easy to make pretty URLs.
by zacharyvoase 4y ago
The fact that it ends in `.php` is not inspiring confidence. It's 2022, it's so easy to make pretty URLs.
- fomine3 4y agoCool URIs don't change
- Kwpolska 4y agoA URI ending in .php is not cool (never was), and this advice is most important for content (articles etc.), not necessarily for account management pages.
- paledot 4y agoWhich is why you shouldn't include implementation details in your URL.
- fennecfoxy 4y agoObfuscation isn't security etc etc
- paledot 4y agoI wasn't commenting on the security implications. My point was that bleeding implementation details like .php in your URLs is silly because that URL might end up being served by a Node app one day. But on the security point, a URL ending in .php does imply a "we just YOLO'd a bunch of bare scripts into the webroot" application architecture, which is not confidence inspiring as a user and sure looks attractive to pentest.