DNN Forums

Ask questions about your website to get help learning DNN and help resolve issues.

Best resource for understanding DNN URL management/rewrites/redirects?

 5 Replies
 0 Subscribed to this topic
 40 Subscribed to this forum
Sort:
Author
Messages
Growing Member
Posts: 37
Growing Member

Hi all - I'm working with a firewall administrator who is evaluating a recent seeming DDOS attack, where several thousands of requests appended different extended numerical path elements to a legitimate page URL, which apparently caused a lot of resource usage and produced a temporary outage.

I was explaining to him the native DNN behavior where, if a child path element doesn't exist, DNN returns the parent path element/page instead. Some research he did indicated that DNN evaluation of that scenario may be overwhelming the server - and his proposal is to change that behavior to return a 404 instead for a missing child path element; I know that the actual behavior is there for a reason, and is dependent on the modules involved dynamically creating elements, and whether the path elements (in a friendly URL) actually represent path elements or query parameters, which can be hard to discern at times. 

Is there a good resource somewhere explaining how and why this all works the way it does? I would like to understand it more completely.

Thanks! David

Advanced Member
Posts: 208
Advanced Member
Helpful Replier
Helpful Replier
Thanks for being such a helpful replier!
MVP
MVP
You're an MVP!
New Poster
New Poster
Congrats on posting!

I doubt that was a Dos Attacked, there are far better ways to create DoS.  Just good Caching practise would probably be good enough to stop DoS on a public visible page that a robot what hitting.  And what is severing the 404 page to make it better? I presume a load balance server?  

I think DNN is doing it basically right, you want everyone to find something on your website, not 404s.

If you do want to stop any URL from hitting the DNN installation/Server, you can implement a load balance server which filters valid URL before passing them to the DNN server.  

I tried to post the ChatGPt answerm which is good, but I got security warning.  But try chatgpt.

 

 

Senior Member
Posts: 1325
Senior Member
3 Helpful Replier
Helpful Replier
Thanks for being such a helpful replier!
Lifesaver
Lifesaver
You're Life Saver!
New Poster
New Poster
Congrats on posting!
3 Engaged Reader
Engaged Reader
You are an engaged reader!

The reason for this is that DNN uses "child urls" for things like edit and settings links and it also allows modules to create and process "detail" urls.
As an example; the blog module.
It interprets the url and if that contains a blog entry id, it renders a detail view instead of the list view.

Our SEO redirect module allows you to force a 404 on certain pages (you have to be sure there's not module with "details" on that page or these will not work any more.

See: https://www.40fingers.net...cts/DNN-SEO-Redirect 

The Force404 option

BTW I always amazes me how many bots just try random urls..
We see that on all the sites we host.. 

Advanced Member
Posts: 208
Advanced Member
Helpful Replier
Helpful Replier
Thanks for being such a helpful replier!
MVP
MVP
You're an MVP!
New Poster
New Poster
Congrats on posting!
Just want to agree with Timo on the amount of bots.......I am shocked... I always think DoS Attacked, but they often doing nothing but looking at the page. I think the Bot situation has got more and more and more. I'm convinced that an AI robot it also testing forms on websites for holes.

We use https://raw.githubusercon.../master/spammers.txt and some other list to click these from hitting out servers.
Advanced Member
Posts: 140
Advanced Member
2 Helpful Replier
Helpful Replier
Thanks for being such a helpful replier!
MVP
MVP
You're an MVP!
3 Engaged Reader
Engaged Reader
You are an engaged reader!
Avid Reader
Avid Reader
Avid Reader art thou!
As others have mentioned, you can do things IF you have a page without a module that needs truly dynamic stuff in it, however, if you have a module that relies on unknown URLS (A blog/news module for example) that gets a lot harder to get the behavior under control.

As for the initial question about explaining it to others, the best way I have found is to consider the following URL segments

/Articles/News
/Articles/News/My-Real-Article
/Articles/News/My-Fake-Article

In the DNN world in most cases the only real DNN page is the first one. The second one shows a real article, as "My-Real-Article" maps to an article within the mdoule being used on the page.

The last one doesn't map, but just shows the landing page since it wasn't found.

To change that behavior you really need the blog/article module to try and enforce a 404, which many do not.
Growing Member
Posts: 37
Growing Member
Thanks for your replies, everyone - that does help me understand this better, and I can pass that along. If my client/firewall admin is really serious about forcing 404 responses for non-existent child pages when seeing certain attacks, it looks like Timo's SEO Redirect module option would manage that nicely.

Thanks again!
David

These Forums are for the discussion of the open source CMS DNN platform and ecosystem.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. If you have (suspected) security issues, please DO NOT post them in the forums but instead follow the official DNN security policy
  2. No Advertising. This includes the promotion of commercial and non-commercial products or services which are not directly related to DNN.
  3. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  4. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  5. No Flaming or Trolling.
  6. No Profanity, Racism, or Prejudice.
  7. Site Moderators have the final word on approving / removing a thread or post or comment.
  8. English language posting only, please.

Would you like to help us?

Awesome! Simply post in the forums using the link below and we'll get you started.

Get Involved