This lesson's interactive features are locked, please to keep using them

Public File Leaks

Imagine a recipe app that correctly limits static serving to web/public/, but leaves web/public/internal-config.json inside that directory. Derp.

You could add special-case handler logic that blocks that one filename. But then the security boundary depends on logic someone might forget to preserve. Remove private data from the public directory entirely. It's simpler, and simpler is easier to keep secure.

An obscure filename or unlinked URL doesn't make a public file private. If server-side code needs the file, store it outside the static root.

Assignment

Bearly Secure publishes operational details from web/public/internal-config.json. Remove the private file without breaking intended assets.

Remove web/public/internal-config.json.
Start the app.
Confirm http://localhost:3030/internal-config.json returns 404 Not Found while http://localhost:3030/styles.css still loads.

With Bearly Secure still running, run and submit the CLI tests from the project root.