How do I prevent node enumeration? I am currently developing a Drupal 8 site that will consist of one only central content type with a minimal menu structure. The user is supposed to navigate the site only by using a search/filter form (similar to a search engine) and I would like to disallow all methods for locating content other than using the search form.
The problem is: All content in Drupal is normally accessible by using &lt;site&gt;/node/&lt;somenumber&gt;, which makes it easy to locate all content by simply counting upwards (I think, this process is called node enumeration). I know, I can use the Pathauto module to generate a pattern for URL aliases (say, a random hash). Unfortunately, that won't prevent the original URLs from being accessible: When entered, they will simply be forwarded to the generated aliases.
So, my question is: Is there a way to prevent this node enumeration from being possible? Is it possible to have the node available only under the generated aliases and not forward the original URLs?
All help would be much appreciated.
This is difficult, because it is core functionality.
What you could do to prevent people from checking node/4, node/5 etc is blocking access when a url request has a certain structure. You'd need a custom module with an EventSubscriber.
Here is an example how to intercept such url requests and how to redirect them. In this case it is a taxonomy term view but the underlying thought is the same: https://stefvanlooveren.me/blog/redirect-taxonomy-terms-filtered-view-page
Further, you'd have to check in your html rendering that every reference to a node id is hidden. Quite some work but if it is really necessary its possible.