GWT's compilation-mappings file publicly available

user_5110255 0
Viewed 57

During a security audit I came across this file in a web server. It is publicly available for unauthenticated users. After doing some research (this url proved very useful What are those cache.js and compilation-mappings files) I can't seem to find my answer anywhere:

Should this file be available for the public? Does it present a security risk? Or on the other hand it has to be publicly available to work out what browser is interacting with the web server?

Thanks

gwt
1 Answers

The compilation-mappings file contains the exact same information as the *.nocache.js file. It poses no security risk (otherwise, rest assured that it would be produced in another directory).

Google uses it to replace the *.nocache.js and do the script selection on the server (with a custom GWT linker and a custom servlet). But it is not used by "standard" GWT setups, so you can safely delete or block it if you'd rather not expose it.

user_1164720
Related