Skip to content

Consistent routes / URIs for easier security hardening #2505

@DennisGaida

Description

@DennisGaida

⚠️ Please verify that this feature request has NOT been suggested before.

  • I checked and didn't find similar feature request

🏷️ Feature Request Type

Other

🔖 Feature description

Checking the https://github.com/louislam/uptime-kuma/blob/master/src/router.js (and of course all vue.js source files linking to some pages), I see a lot of wild routes.

I would love for all routes that are kind of security-related to be behind a common endpoint (e.g. /settings). Right now there are several routes that are at the root level where I believe they shouldn't be:

  • /manage-status-page
  • /add-status-page
  • /add-maintenance

I haven't looked into more routes, but there are may be others.

✔️ Solution

I would love for these endpoints to be underneath something common like settings, so I would propose something like this for the above examples:

  • /settings/status-page/manage
  • /settings/status-page/add
  • /settings/maintenance/add

Putting everything but status pages (underneath /status) behind /settings would actually help for security purposes, this way I could block / 2FA everything underneath /settings/* and I would know that this is stuff that should be secure.

❓ Alternatives

I could block all routes that I deem security-worthy (pretty much anything, but the root), but that would mean blocking each and every route and possibly there are more routes that will be added at a later date.

📝 Additional Context

I'm willing to go through all routes and create a PR for this, I just don't know whether this would be beneficial to anyone but me and whether I should put the effort into it.

Metadata

Metadata

Assignees

No one assigned

    Labels

    A:coreIssues or PRs describing changes to the core of uptime kumafeature-requestRequest for new features to be addedsecurity

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions