id: http-block-admin-paths
name: Block admin and debug paths
protocol: http
description: Protects common admin, console, and debug endpoints.
category: http
family: web-hardening
tags:
- admin-path
- debug-path
- web
- block
action: block
summary: Protects common admin, console, and debug endpoints.
behavior: Matches the request path against a small denylist and returns a blank 404
  page before the request is forwarded.
source_url: https://docs.mitmproxy.org/stable/addons/examples/
code: |
  import logging

  from mitmproxy import http

  BLOCKED_PREFIXES = (
      "/admin",
      "/debug",
      "/console",
      "/actuator",
  )


  def request(flow: http.HTTPFlow) -> None:
      if flow.request.path.startswith(BLOCKED_PREFIXES):
          logging.warning(
              "[http-block-admin-paths] blocked path=%s",
              flow.request.path,
          )
          flow.response = http.Response.make(
              404,
              b"",
              {"content-type": "text/html; charset=utf-8"},
          )