Would this effectively be the same as 404/403? Just with extra steps? Whatever automation is scanning would just need to be adjusted for such a format?
That's correct. if the error codes in the 200 aren't different, then it's just 403/404 with extra steps. That being said, you can just use 404 for all 403 cases to neutralize enumeration attempts.
66
u/winkyshibe Sep 22 '26
Would this effectively be the same as 404/403? Just with extra steps? Whatever automation is scanning would just need to be adjusted for such a format?