This lesson's interactive features are locked, please to keep using them

Public File Leaks

Imagine a recipe app that correctly limits static serving to public/, but leaves public/internal-config.json inside that directory. Derp.

You could blacklist that one URL:

app.use(
  express.static("public", {
    index: false,
    dotfiles: "ignore",
    setHeaders: (res, path) => {
      if (path.endsWith("internal-config.json")) {
        res.status(404).end();
      }
    },
  }),
);

But now you're relying on some logic someone might forget about to make your /public directory secure. Just remove private data from public/ entirely. It's simpler, and simpler is easier to keep secure.

An obscure filename or unlinked URL doesn't make a public file private. If server-side code needs the file, store it outside public/.

Assignment

Bearly Secure publishes operational details from public/internal-config.json.

Remove the public/internal-config.json file.
Preserve intended public assets such as /styles.css.
Start the app.
Confirm http://localhost:3000/internal-config.json returns a 404 Not Found error page.

With Bearly Secure still running, run and submit the CLI tests from the project root.