RSS FeedLeaking Information in Drupal URLs
Update: It turns out the DA was trolling. We all now know that DrupalCon North America 2016 will be in New Orleans. I've kept this post up as I believe the information about handling unpublished nodes is relevant. I have also learned that m4032404 is enabled by default in govCMS.
When a user doesn't have access to content in Drupal a 403 forbidden response is returned. This is the case out of the box for unpublished content. The problem with this is that sensitive information may be contained in the URL. A great example of this the DrupalCon site.
The way to avoid this is to use the m4032404 module which changes a 403 response to a 404. This simple module prevents your site leaking information via URLs.
Twitter
Reddit
Facebook
LinkedIn| Attachment | Size |
|---|---|
| DrupalCon-Philadephia.png | 139.21 KB |
Misdirection and Disinformation?
Anonymous wrote:https://events.drupal.org/cleveland2016
interesting that both
rcross wrote:interesting that both https://events.drupal.org/cleveland2016 and https://events.drupal.org/philadelphia2016 give an Access Denied, but a typo of https://events.drupal.org/philidelphia2016 provides a 404.
Maybe both are happening :)