hidden pages got discovered

[easy-bios]

Summary

Hey all, yesterday i noticed that someone or something discovered all pages in my application.
Some of them where hidden, so you have to know the exact link to that page. There are no links to this page on the rest of the website.
The pages have no critical information, they are just previews of my email templates.

Nevertheless I think this could be a vulnerability.
Or am I missing some feature I am not able to find in the documentation that explains how someone can discover all pages?

Cheers, Patryk

Additional information

No response

Example

No response

[icyJoseph]

Hi,

This could happen with Source Maps enabled, if in Chrome, you open the DevTools, and go to Source, can you expand the _next/static folder on the left side? Does that show all of your "hidden" pages?

[easy-bios]

Hi,

so _next/static/chunk/pages showing only the public pages.
But thanks to your hint I found where all pages are listed:
_next/static/HASH_0123456789_HASH/_buildManifest.js

Is it possible to remove this file?
Where is this file needed? In the client or only internaly?

[DevDaniloFerrari]

• Next.js has a feature called "link prefetching" where, by default, the framework automatically prefetches linked pages in the background. You can disable this behavior by setting the data-n-p attribute on your Link components.

<Link href="/some-page" prefetch={false}>
  <a>Some Page</a>
</Link>

[easy-bios]

I do not have any link to the hidden pages. That's why they are hidden. ;)

[easy-bios]

Also all admin page paths are shown in the _buildManifest.js.
Of course they are protected in multiple ways, but I don't want a potential attacker to know they even exist.
If I am not logged in with my admin account _next/static/chunks/pages and all the rest of the served code does not give any information about the admin pages, as intended.

[DevDaniloFerrari]

If someone is able to discover all pages in your Next.js application, including hidden pages and admin page paths, it could potentially pose a security risk. While some level of automatic page discovery is inherent to Next.js, you can take steps to mitigate this issue. Here are some suggestions:

1. Page Visibility Control:

• Make sure that the pages you want to keep hidden are not directly exposed in the pages directory. If they are not meant to be accessed by users, consider placing them outside of the pages directory or using a naming convention that clearly indicates their intended purpose.

2. Authentication and Authorization:

• Implement strong authentication and authorization mechanisms. Even if the pages are discovered, users should not be able to access them without the necessary permissions. Ensure that the authentication process is secure and that unauthorized users cannot view admin pages.

3. Server-Side Routing:

• For pages that should only be accessible under certain conditions, consider using server-side routing to handle access control dynamically. This way, you can conditionally serve or deny access to specific pages based on the user's credentials.

4. Security Headers:

• Implement security headers, such as Content Security Policy (CSP), to control how resources are loaded on your pages. This can help mitigate the risk of certain types of attacks.

5. Dynamic Imports:

• Use dynamic imports for pages that should only be loaded under specific conditions. This can help control when and how pages are loaded based on runtime conditions.

6. Minimize Automatic Routing:

• Explicitly specify the routes you want to expose and avoid unnecessary automatic route generation. This can be done by configuring the next.config.js file to limit the pages that are generated automatically.

7. Protecting Admin Paths:

• While admin pages are protected, consider obfuscating or encrypting the admin page paths, making it more challenging for potential attackers to glean information about these paths.

8. Build Manifest:

• Periodically review the generated build manifest (_buildManifest.js) and analyze if there's sensitive information being exposed. If needed, you can explore custom solutions to handle admin paths dynamically without revealing them in the build manifest.

9. Security Audits:

• Conduct regular security audits to identify and address any potential vulnerabilities in your application.

Remember, security is an ongoing process, and staying vigilant against potential threats is crucial. Regularly update your dependencies, follow security best practices, and be proactive in addressing potential security concerns.

[easy-bios]

8. Build Manifest:

• Periodically review the generated build manifest (_buildManifest.js) and analyze if there's sensitive information being exposed. If needed, you can explore custom solutions to handle admin paths dynamically without revealing them in the build manifest.

This would be a solution, but I can't find any resources how to set this up.

[DevDaniloFerrari]

Wouldn't it be better if you handled this with authorization? I think it's better than trying to hide the page.

[easy-bios]

As I said, they are protected.
In detail with NextAuth.js + middleware.
But I don't want potential attackers to know all sensitive paths.

[DevDaniloFerrari]

Keep in mind that preventing users from discovering routes entirely on the client side may not be feasible, but controlling access to those routes is crucial for security.

[sauravj]

any update on this? @easy-bios were you able to fix it?

[easy-bios]

No good solution so far. I just edited the _buildManifest.js manually.

[sauravj]

interesting! isn't it automatically generated? how do you intercept it? or are you overwriting the BuildManifestPlugin?

[easy-bios]

I am just editing the file after the finished build.

[sovetski]

Did you find any proper solution? Why we don't have any easy config possibility with nextjs, to exclude some pages during the build?