Is having a webserver return a 40x response a sufficient compensating control to mitigate Application Security Risk?

Summary

No - SecurityScorecard raises findings across the platform against webservers that are returning any 4xx (e.g. 404) HTTP response. If the application returns a 4xx HTTP response it is still vulnerable to a potential attack against that webserver, including a MitM.

Detail

• https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
• https://en.wikipedia.org/wiki/Man-in-the-middle_attack#Defense_and_detection
• https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP#threats