DEV Community

kozhevniko
kozhevniko

Posted on

YOURLS private mode still has an API boundary

#zoomeye #zoomeye06yourls

YOURLS private mode still has an API boundary

YOURLS is a self-hosted URL shortener. Its public purpose is to accept and serve short links, so a visible deployment is not automatically a mistake. The security question is whether the administration and API surfaces have the same boundary as the redirect service.

Observation

At 08:42 on November 4, 2026 (UTC+8), a count-only ZoomEye SDK query with sub_type=all, page 1, and pagesize 1 returned zero application matches for app="YOURLS" and 1,100 title matches for title="YOURLS". The title count is a broad candidate set. It can include actual installations, project documentation, and pages that mention the product without exposing an administration endpoint. No individual host was tested for write access.

Private mode and the API

YOURLS documents a private/public setting. Private mode protects the administration area with a login and password. The project also explains that the API can be made public while the rest of the installation remains private. That combination is intentional, but it means the phrase "private" does not cover every route. An operator should list which routes accept link creation and which simply redirect visitors.

The API model adds two credential paths. A client can send a username and password, or use a signature token for passwordless requests. The project documentation describes the signature mechanism and the required parameters. A signature is a long-lived automation credential even when the underlying user password is strong. It should have an owner, a purpose, and a removal date.

Control review

Review these controls:

  • Confirm whether private mode is enabled and which routes are exceptions.
  • Inventory API-enabled users and signature tokens.
  • Test a revoked token after the associated account is disabled.
  • Review short-link creation for abuse, bulk automation, and unsafe destinations.
  • Keep administration on a management network when the deployment allows it.
  • Monitor redirect changes for unexpected domain or destination shifts.

The public redirect surface should remain fast and observable. The write surface should be small, authenticated, and logged. If the same internet-facing process serves both, a reverse proxy or application rule should distinguish them without relying on a hidden path name. Hidden paths are not access control.

The 1,100 title matches are useful for discovering candidate deployments and tracking changes in the visible population. They are not 1,100 vulnerable shorteners. A title can be copied, and a login page may be intentionally public. Pair the external count with an owner list, a redirect inventory, and an API-token review.

The operational goal is to know which links the organization can create, which accounts can create them, and how quickly a compromised token can be revoked. That review makes the distinction between a public redirector and an exposed control plane concrete.

References

Top comments (0)