Hi Patrik,
What you observed is worth documenting in the penetration-test report, but the accessibility of a client-side page definition does not, by itself, mean that an authorization bypass exists.
Mendix delivers page-related resources to the browser so that the client can render the application. The structure may reveal page names, entity and attribute references, and operation identifiers. These should not be treated as secrets.
1. Verify server-side authorization
In Studio Pro, check that every entity has appropriate entity access rules and that microflows and nanoflows have the correct allowed roles. Test that an unauthorized user cannot retrieve protected data or execute restricted operations, even if they know the relevant identifiers.
2. Review anonymous-user access
If anonymous access is enabled, verify that the anonymous role has only the minimum permissions required. In particular, check entity access, published REST/OData services, and any microflows exposed to anonymous users.
3. Review the application security configuration
Set the security level to Production and use App → Security → Check security to identify security configuration issues. Also review App → Show Security Overview to inspect page, entity, microflow, and nanoflow access for each user role.
4. Enable Strict Page URL Checking
In the application security settings, enable Strict Page URL Checking and resolve any resulting consistency errors. This helps identify page security issues for pages that are accessible only through a page URL. It does not make client-side page definitions private.
5. Avoid blocking the static page resources indiscriminately
I would not block /dist/pages/ simply to hide page definitions. These resources may be required by the client, and blocking them can break application functionality without providing meaningful data security.
The client implementation may affect the format and location of the page resources, but the security principle remains the same: client-side code and page structure must not be considered confidential. Authorization must be enforced by the Mendix runtime and the relevant backend services.
Official references:
My recommendation: Treat the exposed page definition as an information-disclosure finding only if it reveals information that your security requirements actually classify as confidential. Then verify that the referenced data and operations remain inaccessible to unauthorized users. If the penetration tester can retrieve protected business data or execute restricted operations, that is a separate authorization vulnerability that must be fixed.
Hope this helps! If you find this answer helpful, please mark it as the accepted answer.