Which protection ensures that links to sensitive pages can only be reached from within an application?

The URL Closure protection is specifically designed to prevent forceful browsing by ensuring users follow the intended navigational path of a web application. It works by tracking each user's session and verifying that every requested URL is linked from a page the user has previously and legitimately visited within that session. This prevents attackers from bypassing the application's workflow by directly typing or bookmarking URLs to sensitive pages, effectively ensuring that such pages can only be reached from within the application's flow.

A. Form Field Consistency Check: This protection validates the integrity of submitted web forms, not the navigational path taken to reach a page.
B. Buffer Overflow Check: This protection prevents attacks that exploit memory buffer vulnerabilities and is unrelated to controlling application navigation flow.
D. Deny URL: This provides a static, blacklist-based protection by blocking specific URLs, but it does not dynamically enforce a valid navigational path.

1. Citrix ADC Documentation. (n.d.). URL Closure. Citrix Product Documentation. Retrieved from https://docs.citrix.com/en-us/citrix-adc/current-release/application-firewall/protections/url-closure.html. (This document states, "The URL Closure feature prevents clients from accessing URLs on your web site that they are not supposed to access... It does this by tracking how each user navigates your web site.")

2. Citrix ADC Documentation. (n.d.). Advanced Policies for Web App Firewall. Citrix Product Documentation. Retrieved from https://docs.citrix.com/en-us/citrix-adc/current-release/application-firewall/advanced-policies.html. (URL Closure is listed and described as a protection against forceful browsing.)