nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Blocking .xml files from being visable in web dubugger programs ie: Fiddler

MattPohl

I am curious if there is any way to block the visibility of .xml files when tracking web traffic in programs such as Fiddler. Attached is a screen shot showing the situation. For instance, I can see the config.xml file for my application in Fiddler which can than be opened. Once opened, the tokens used to pass the secure services through the FlexViewer become visible. I am not using a reverse proxy setup, but not sure if that would resolve the issue. Any thoughts would be greatly appreciated.

Matt

Fiddler.jpg

Find more posts tagged with

Accepted answers

BjornSvensson

My goal would be to block the visability of .xml files from everybody thus keeping the tokens truly secure from everyone who had access to the application.

That's not possible. If the "application" can see it, then Fiddler etc can see it.

All comments

GISDev1

Tim-

Thanks for your response. Yes, this would block those types of files from being displayed in Fiddler for computers I have access to, but not client computers. My goal would be to block the visability of .xml files from everybody thus keeping the tokens truly secure from everyone who had access to the application.

~Matt

You know the client being able to see the Token in the config is no big deal right? The token is tied to either the Referrer IP or the Referrer URL. If an attacker has access to use either of those as a proxy to your ArcGIS Server box, you have a more serious problem on your hands.

Of course you can "hide" the tokens and not even use them in the config by hard-coding them in the source code which gets compiled into the index.swf. (The .swf can certainly be decompiled by the way).

This won't really matter because the token will be seen going over the wire anyways. And like mentioned before, this token is no big deal.

MattPohl

Thanks Bjorn, this was my assumption but thought I would ask anyway.

~Matt

BjornSvensson

My goal would be to block the visability of .xml files from everybody thus keeping the tokens truly secure from everyone who had access to the application.

That's not possible. If the "application" can see it, then Fiddler etc can see it.

MattPohl

Tim-

Thanks for your response. Yes, this would block those types of files from being displayed in Fiddler for computers I have access to, but not client computers. My goal would be to block the visability of .xml files from everybody thus keeping the tokens truly secure from everyone who had access to the application.

~Matt

TimDine

Fiddler can accept regular expressions in it's filter tab. Check the "Show only if URL contains" check box. Enter an expression like "REGEX:(?insx).*[^(css|png|xml)]$" in the text box without quotes. This expression would hide css, png, and xml files.

http://fiddler2.com/documentation/KnowledgeBase/Filters

Join the Conversation

Signed in members can post, follow updates, and more. New here? Register a free account.

Quick Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.