URL Path Authorization Enforcement (Forced Browsing Prevention)
Description
Enforce URL-pattern-based authorization at the web server or reverse proxy layer so that restricted paths (administrative consoles, debug endpoints, configuration panels, internal APIs, backup files, and deployment artifacts) are denied to unauthorized requesters before the request reaches application code. The control operates as a default-deny URL filter: only explicitly permitted URL patterns are accessible to each authenticated role, and any request to an undefined or restricted path returns 403 Forbidden. This complements application-layer authorization (CME-907, CME-909) by providing infrastructure-level defense-in-depth against forced browsing, where an attacker discovers and directly requests URLs that bypass application navigation and menu-driven access control. Configuration is enforced via web server directives (Apache httpd Location/Directory with Require, nginx location blocks with deny/allow, IIS URL Authorization rules) or Java EE security-constraint elements in web.xml with deny-uncovered-http-methods enabled.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Privileges Required (PR) | N → L | Forced browsing to administrative or internal endpoints fails because the web server rejects unauthenticated requests to restricted URL patterns before the application processes them; the attacker must first obtain valid credentials to reach any protected path |
| Attack Complexity (AC) | L → H | Discovering and accessing a restricted endpoint requires bypassing both the web server URL authorization rules and the application-layer authorization checks; simply guessing or enumerating URLs is insufficient because the infrastructure layer denies access to any path not explicitly permitted for the caller's role |
CWE Relationships
Verification
Verify that the web server or reverse proxy enforces URL-pattern-based authorization on restricted paths, and that unauthenticated requests to administrative or internal endpoints are denied
# Expected: Authorization directives present on administrative and restricted URL paths (e.g., /admin, /console, /debug)
# Expected: Restricted location blocks with authentication or deny directives for administrative paths
# Expected: 401 or 403 (access denied without valid credentials)
# Expected: URL Authorization rules restricting access to administrative paths to specific roles