-
-
Notifications
You must be signed in to change notification settings - Fork 7.6k
Consistent routes / URIs for easier security hardening #2505
Description
⚠️ Please verify that this feature request has NOT been suggested before.
- I checked and didn't find similar feature request
🏷️ Feature Request Type
Other
🔖 Feature description
Checking the https://github.com/louislam/uptime-kuma/blob/master/src/router.js (and of course all vue.js source files linking to some pages), I see a lot of wild routes.
I would love for all routes that are kind of security-related to be behind a common endpoint (e.g. /settings). Right now there are several routes that are at the root level where I believe they shouldn't be:
/manage-status-page/add-status-page/add-maintenance
I haven't looked into more routes, but there are may be others.
✔️ Solution
I would love for these endpoints to be underneath something common like settings, so I would propose something like this for the above examples:
/settings/status-page/manage/settings/status-page/add/settings/maintenance/add
Putting everything but status pages (underneath /status) behind /settings would actually help for security purposes, this way I could block / 2FA everything underneath /settings/* and I would know that this is stuff that should be secure.
❓ Alternatives
I could block all routes that I deem security-worthy (pretty much anything, but the root), but that would mean blocking each and every route and possibly there are more routes that will be added at a later date.
📝 Additional Context
I'm willing to go through all routes and create a PR for this, I just don't know whether this would be beneficial to anyone but me and whether I should put the effort into it.