Skip to content

Commit 864c028

Browse files
committed
minor #17309 [Security] Add caution on symfony cli web server exposing env vars on private network (94noni)
This PR was squashed before being merged into the 6.2 branch. Discussion ---------- [Security] Add caution on symfony cli web server exposing env vars on private network Hi, One can understood that this web server is a great tool for development purposes but this addition should be added imho for knowledge :) Context: when checking some local data accessible on local network with coworker we arrived to display a symfony cli served app profiler (obviously it is in `dev` env) and in the profiler > request/response panel > server parameters > regular env vars => **thus exposing also symfony unrelated env vars which are included** friendly ping `@wuchen90` ^^ Commits ------- 9c3023e [Security] Add caution on symfony cli web server exposing env vars on private network
2 parents 4cf29bc + 9c3023e commit 864c028

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

setup/symfony_server.rst

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,13 @@ other features that sooner or later you'll need when developing web projects.
1111
Moreover, the server is not tied to Symfony and you can also use it with any
1212
PHP application and even with HTML or single page applications.
1313

14+
.. caution::
15+
16+
This server will automatically expose all environment variables available
17+
in the CLI tool context, **which can lead to security issues**.
18+
One should assert that its server is not accessible on local network without
19+
consent.
20+
1421
Installation
1522
------------
1623

0 commit comments

Comments
 (0)