Several json pages in Security essentials don't authenticate the user if the full url is typed in.

[jlstanley]

there are 2 web pages in the Security Essentials app that come up on security scans without authenticating. Authentication is setup with azure federation and works fine normally but if you type in the full url to these 2 locations:
http://splunk.domain
.net/static/app/Splunk_Security_Essentials/components/data/ShowcaseInfo.json
or
http://splunk.domain.net/en-US/static/@D9F7C1F9464941AC960FA32AE0179322246AFEEF74E65DB88455B73C7C752...

[David]

This is more-or-less by design, and is owned by Splunk Enterprise. No sensitive data is stored in those JSON files, only default out-of-the-box content. Anything custom gets tossed into the kvstore.

Are you running into any issues given that those files are exposed?

[jlstanley]

Not an issue per se, other than the fact it is accessible without authenticating. Can it be fixed or is there a work around so it doesn't come up in security scans?

[David]

The answer today is that you can’t work around this. My guess is that we have it set up like this because we can expose reports without authentication – there’s an embedded auth code in those links for the initial request of the report, but some reports can require static web assets and maintaining the auth code gets tricky. The PM response the last time this came up was as follows, basically indicating that nothing in there should ever be private:

$APP_HOME/appserver/static directory contains web resources such as images, CSS or HTML used by the app and these resources don’t need any authentication.
http://docs.splunk.com/Documentation/Splunk/6.4.0/AdvancedDev/ShareYourWork#Files_and_directories_fo...

That said, that was from two years ago -- I'll ask if there's any plan to make changes here and let you know.