0

I am currently developing a Drupal 8 site that will consist of one only central content type with a minimal menu structure. The user is supposed to navigate the site only by using a search/filter form (similar to a search engine) and I would like to disallow all methods for locating content other than using the search form.

The problem is: All content in Drupal is normally accessible by using <site>/node/<somenumber>, which makes it easy to locate all content by simply counting upwards (I think, this process is called node enumeration). I know, I can use the Pathauto module to generate a pattern for URL aliases (say, a random hash). Unfortunately, that won't prevent the original URLs from being accessible: When entered, they will simply be forwarded to the generated aliases.

So, my question is: Is there a way to prevent this node enumeration from being possible? Is it possible to have the node available only under the generated aliases and not forward the original URLs?

All help would be much appreciated.

Improve this question
8
  • 3
    This question comes up surprisingly often - When entered, they will simply be forwarded to the generated aliases. What’s the problem with that exactly? Why does it matter that people can view content that they have access to anyway by guessing a number? The only thing I can think of is that you’re trying to use the navigation UI as some sort of access control, which would be less than ideal
    – Clive ♦
    Sep 22, 2020 at 8:42
  • Yes, indeed, this is intended as a kind (!) of access control, but not in a strict sense (there will be other security mechanisms in place). The problem is: Most of the content will be available freely, but should only be accessible via a dedicated form to prevent the users from finding out, what is available. Thus, I would like to prevent "leeching" (mass downloading).
    – Marcus C.
    Sep 22, 2020 at 8:51
  • 3
    Disable public access and use Node Authlink module: drupal.org/project/node_authlink
    – Hudri
    Sep 22, 2020 at 9:16
  • If the problem is users who access too many nodes by entering the URL directly in the browser address bar, an access control handler could limit the number of nodes per second a user should be able to access in that way.
    – apaderno ♦
    Sep 22, 2020 at 9:42
  • 2
    Basically instad of hiding /node/XXX you first disallow anoymous access to /node/XXX and then use Node Authlink module to allow anonymous access to nodes with something like /node/XXX?authkey=secret_hash_for_this_node
    – Hudri
    Sep 22, 2020 at 10:48

1 Answer 1

Reset to default
2

This is difficult, because it is core functionality. What you could do to prevent people from checking node/4, node/5 etc is blocking access when a url request has a certain structure. You'd need a custom module with an EventSubscriber.

Here is an example how to intercept such url requests and how to redirect them. In this case it is a taxonomy term view but the underlying thought is the same: https://stefvanlooveren.me/blog/redirect-taxonomy-terms-filtered-view-page

Further, you'd have to check in your html rendering that every reference to a node id is hidden. Quite some work but if it is really necessary its possible.

Improve this answer
2
  • Thanks, that sounds like a good idea. Frankly, I was hoping for a simpler solution, like turning off some switch... but you are probably right in that this is indeed core functionality and could become difficult. Will do some testing...
    – Marcus C.
    Sep 22, 2020 at 10:13
  • Yeah, maybe you find a contrib module to do the job. Personally I like to stick to core modules and some custom code :).
    – Stef Van Looveren
    Sep 22, 2020 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.