I am testing a new version of a web site and when requesting the site URL it redirects to a URL with the port number 80 appended to it, for example requesting www.example.com redirects to www.example.com:80.
Does this pose a security risk?
Add a comment
|
2 Answers
Showing port 80 is no more harmful that showing "http". In fact, a fully qualified URL should look like this:
http://www.example.com.:80
Many of these pieces are now assumed by the browser in order to make users' (especially non-tech users') lives easier. In fact, most tech people don't know about the trailing dot at the end of the top level domain. (The DNS equivalent of the root symbol.) Now users can just type in:
example.com
The greater question is, "Why is your system displaying the port number?". I'm guessing something is mis-configured.
There is nothing "harmful" with it but it will look "wrong" to users and it will likely make some of their spidey senses tingle with "Why is this :80 there, I don't see that on every other website".
Port 80 is the standard http port, so you aren't giving out any information. It's not technically "wrong" since every other http request is going to port 80, but I think users will feel that it is "wrong".
I would avoid it in any website I was working on.
-
1Great answer. While initially I thought of a potential security risk (security by obfuscation) honestly anyone who would be attempting to attack the service would easily be able to determine the port even if it wasn't the standard port. However for daily users, they would likely see it as either odd or off putting and potentially, the paranoid users, would see it as a security issue for them. Upvoted. Commented Nov 6, 2014 at 16:37
-
1Very well explained and top the point. Too me as well the first thought that occurred was security risk, but that as explained in above comment can be found out by any other means. From usability point of view it does not look right! Good one... Commented Nov 8, 2014 at 1:50