Security Issue: Valid API URI oracle from unauthorised clients

[#1]

Our APIs are not public and require a client certificate in addition to authentication for access. We don't want to release any information at all about our APIs to the public at large.

Situation:
A security audit of our system found that an unauthorized user can leverage the developer portal to enumerate existing API URLs from the Internet. This is possible as it's leaking valid resources with verbose error messages: "Access denied" versus "Page not found".

Example:
"Access denied"
https://<host-alias>/xyz/apis/post/v1/partnerData
"Page not found"
https://<host-alias>/xyz/apis/post/v1/foobar

Suggested fix:
Have the developer portal use the same error message for valid and invalid resource requests.

The developer documentation on the developer portal is password-protected. The APIs are also protected in a variety of ways, including password-protection. That doesn't mean there is not a security issue here. The point is that anybody on the Internet can tell what our API endpoints are, even without authenticating. This is information that should not be leaked onto the Internet regardless of whether the endpoints are protected or not.

[chrisnovak · Accepted solution]

By default, Drupal out of the box will display 403 pages for access denied and 404 pages for pages not found.

To change this behavior, you could have the 404/403 pages redirect to the login page: https://www.drupal.org/project/anonymous_login

Or, you could use this module to make all 403 pages become 404 pages:
https://www.drupal.org/project/m4032404

Of course you can also write your own custom module to change the behavior to anything you need.