search

EarthSystemCoG / COG

COG source code
BSD 3-Clause "New" or "Revised" License
8 stars 16 forks source link

Return HTTP status code 404 for non-existing URLs #1309

Closed LucaCinquini closed 7 years ago

LucaCinquini commented 8 years ago

Who: Luca

The JPL scan identifies a Low security risk when pages that do not exist, such as:

https://esgf-node.jpl.nasa.gov/ac/subscribe/admin.aspx/

return a 200 status code. We should instead return 404 (not found).

LucaCinquini commented 8 years ago

The following classes of URLs will now immediately return http status 404 (not found)

LucaCinquini commented 8 years ago

Additionally, I have made the URL patterns case-insensitive, so that a request to .php or .PHP will equally fail.

murphysj commented 7 years ago

@LucaCinquini

when I go here: https://cog-cu-dev.colorado.edu/ac/subscribe/admin.aspx/ I just get a blank white page?

LucaCinquini commented 7 years ago

That’s ok, the HTTP status code should be not found or something like that, you can look at that with FireFox.

On Aug 31, 2016, at 1:31 PM, Sylvia Murphy notifications@github.com wrote:

@LucaCinquini https://github.com/LucaCinquini when I go here: https://cog-cu-dev.colorado.edu/ac/subscribe/admin.aspx/ https://cog-cu-dev.colorado.edu/ac/subscribe/admin.aspx/ I just get a blank white page?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/EarthSystemCoG/COG/issues/1309#issuecomment-243874748, or mute the thread https://github.com/notifications/unsubscribe-auth/AAm4gyQRFBpCT-EI-suLoZRLp31y-tgdks5qldaPgaJpZM4Jdk1Y.

murphysj commented 7 years ago

looked at response header, 404 was found.