Web Security · Junior · Question 6 of 75
Why is "security through obscurity" (for example, a secret admin URL) not real protection?
- ✓Correct answer: Hidden things get found through logs, guessing or leaked code, so a real access check is still needed
- 2Because browsers refuse to open URLs that aren't linked from the home page
- 3Because search engines are required to index every URL
Explanation
Obscurity can slow an attacker down, but it can't replace authentication and authorization. The admin page must check who is calling it.