A 3rd party security consultancy identified a risk in our Angular SPA/ASP.NET WebAPI application under the area of Information Disclosure, which we have been told to resolve.
The risk is due to the nature of an Angular application wherein the application interface is driven by client-side javascript and URLs to sensitive areas may be discovered by looking through the JS.
EG.
// Inside the user-controller.js angular controller
$scope.newRecord = function () {
$location.url('admin/users/new');
};
They didn't even notice our repositories which contain all the calls to endpoints on the WebAPI back end!
// From the user-repository.js angular service
save: function (record) {
return $resource('api/users').save(record);
}
All access to endpoints are secured in the WebAPI back end and unauthorized access will be rejected. However the Security Consultancy says:
Whilst lower privilege users would not be able to navigate to these directories, the confirmation that these pages existed within the application could facilitate attacks.
Traditional .NET methods of using serverside generated HTML is out of the question as the front end is a pure Angular Application with no .NET interaction aside from WebAPI calls and is language agnostic. I can only imagine creating a new angular service which calls the WebAPI for a dictionary of URLs based on their access level, but its a lot of work and added complexity.
Personally, it seems like overkill and am worried a resolution would require more effort than it's worth as we already effectively manage the security of the application.
Question
Is there a simple and accepted strategy for dealing with this issue in an AngularJS application? What are the best methods others have used to overcome this surly widespread "vulnerability"?