# Bug OP-12647 - robots.txt leaks public project identifiers

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-12647

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module |  |
| Target versions | 12.5.6 |
| Observed in versions | 12.5.0 |
| Sprint | 12.5.6 |
| Backlog bucket |  |
| Bug found in version (deprecated) | 12.5.x |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Steps to reproduce

1.  Enable "Authentication required" under Administration -> Authentication
2.  Create a public project
3.  Visit /robots.txt

### What is the buggy behavior?

The `robots.txt` includes `Disallow` directives for all public projects which exposes their identifiers which may be confidential.

For example:

```text
User-agent: *
Disallow: /projects/2/repository
Disallow: /projects/2/work_packages
Disallow: /projects/2/activity
Disallow: /projects/2/search
Disallow: /projects/your-scrum-project/repository
Disallow: /projects/your-scrum-project/work_packages
Disallow: /projects/your-scrum-project/activity
Disallow: /projects/your-scrum-project/search
Disallow: /projects/1/repository
Disallow: /projects/1/work_packages
Disallow: /projects/1/activity
Disallow: /projects/1/search
Disallow: /projects/demo-project/repository
Disallow: /projects/demo-project/work_packages
Disallow: /projects/demo-project/activity
Disallow: /projects/demo-project/search
Disallow: /activities
Disallow: /activity
Disallow: /search
```

Where `your-scrum-project` and `demo-project` are the identifier which one may not want to have exposed publicly.

### What is the expected behavior?

When "Authentication required" is enabled, all paths should be disallowed without listing all public project paths.

```text
User-agent: *
Disallow: /
```

**OpenProject version**

This affects all OpenProject versions since about 14 years ago.