How to stop forceful browsing?
-
Check authorization on each page
-
Name files with un-guessable names
-
Place all accessible files in the same directory
-
ACL's on the web root
Authorization checks prevent unauthorized access by verifying permissions for each request. Obscurity (B) is not real security since attackers can discover file names through other means. File organization (C) and ACLs (D) don't stop direct URL manipulation attacks.
Forceful browsing is defeated by enforcing proper authorization checks on every page or resource, so that even if a user directly requests a URL they weren't given a link to, the server still verifies they're allowed to see it. Relying on obscure filenames, grouping files in one directory, or web-root ACLs is 'security through obscurity' or coarse-grained access control — none of which actually verify the requester's permission for that specific resource.