Many years ago, Tim Berners-Lee, father of the World Wide Web, spoke at a conference. His message was that URLs that users could decipher were a bad idea. Web applications should employ URLs that are deliberately complex—black boxes for which only the Web server has a key. That way, programmers could ensure and control the user experience.

This makes sense from a security perspective as well: Apart from exposing the underlying logic of Web applications in a way that invites exploits like SQL injection, easily apprehended URLs facilitate attacks based on legal but malicious HTTP requests designed to break a server. Many exploits on many Web servers—most often Microsoft IIS—have been based on URLs that were technically legal but employed buffer overflows or similar techniques.

[ Read more ]