[Security] Hidden front controller for Nginx #4295
Conversation
…running Symfony. app.php is widely known as our default front controller. It is a small effort by security through obscurity. For Apache, this 301 must be replaced by 404: https://github.com/symfony/symfony-standard/blob/77ee2a83c085169e0bd221510b5693dca504f682/web/.htaccess#L37 | Q | A | ------------- | --- | Doc fix? | no | New feature? | no | Applies to | 2.0+ | Tests pass? | yes | Fixed tickets |
phansys
changed the title
* Splitted config for PROD and DEV environments.
|
Hmm, to be honest, I don't understand any of these principles. So I can't say anything about this PR or decide if it's wrong or not. @symfony/team-symfony-docs can you please help? :) |
|
I'm no Nginx expert. @phansys can you explain a bit more what this change is supposed to do? |
|
If I understand this correctly, this gives us the exact same behavior as before, except that I can no longer go to I haven't used this internal option before, so I'm trusting it works like this :). I would add a little comment about it that explains what it does. Something like this: # Causes a 404 page if someone goes to example.com/app.php/some-page
# This can obscure, slightly, the fact that this is a Symfony2 app |
|
Hi @xabbuh. Before: After: |
|
@phansys well-said. If you can summarize that into a short comment to put in the code block, I am a 👍 on this. |
|
I see and I agree that this makes sense in the prod environment. However, I wouldn't add these rules to the dev environment. It makes things more complex and these files shouldn't be available in public at all. |
|
Thank you @weaverryan. If you want, I can add more verbosity in it. |
|
@phansys But is the part for the dev environment really needed? What happens when we omit it? Edit: Never mind, it was there before. So it's probably needed. |
|
@xabbuh, the part for DEV is needed in order to serve the app when you are in development phase (with debug toolbar enabled, etc). IE, for using |
|
Both files shouldn't be present at all in that case. But yes, adding an additional comment might be useful too. |
|
Docblock for DEV rule updated. |
|
Thanks for the really nice addition and edits Javier! This is better than before and helps show people options they have and why. Great work! |
This PR was submitted for the master branch but it was merged into the 2.3 branch instead (closes #4295). Discussion ---------- [Security] Hidden front controller for Nginx For Nginx in PROD env, this makes more difficult to know that app is running Symfony. app.php is widely known as our default front controller. It is a small effort by security through obscurity. For Apache, [this 301 must be replaced by 404](https://github.com/symfony/symfony-standard/blob/77ee2a83c085169e0bd221510b5693dca504f682/web/.htaccess#L37). | Q | A | ------------- | --- | Doc fix? | no | New feature? | no | Applies to | 2.0+ | Tests pass? | yes | Fixed tickets | Commits ------- fed56c2 Updated docblock for config in DEV environment. d1f1b33 * Replaced IF statement by "internal" directive. * Splitted config for PROD and DEV environments. ebf4ea8 For Nginx in PROD env, this makes more difficult to know that app is running Symfony. app.php is widely known as our default front controller. It is a small effort by security through obscurity. For Apache, this 301 must be replaced by 404: https://github.com/symfony/symfony-standard/blob/77ee2a83c085169e0bd221510b5693dca504f682/web/.htaccess#L37
|
Thank you @weaverryan, @xabbuh. |
* 2.3: A few small improvements to the EventDispatcher Component docs Fixes thanks to @xabbuh [#4295] Tweaking notes language Updated docblock for config in DEV environment. * Replaced IF statement by "internal" directive. * Splitted config for PROD and DEV environments. For Nginx in PROD env, this makes more difficult to know that app is running Symfony. app.php is widely known as our default front controller. It is a small effort by security through obscurity. For Apache, this 301 must be replaced by 404: https://github.com/symfony/symfony-standard/blob/77ee2a83c085169e0bd221510b5693dca504f682/web/.htaccess#L37 [Best Practices] removed unused link in business-logic Add missing space in code [Config] Complete security encoder in full default configuration [reference][configuration][security]Added key_length for pbkdf2 encoder Fixed typo Reworded a misleading Doctrine explanation
* 2.5: A few small improvements to the EventDispatcher Component docs Fixes thanks to @xabbuh [#4295] Tweaking notes language Updated docblock for config in DEV environment. * Replaced IF statement by "internal" directive. * Splitted config for PROD and DEV environments. For Nginx in PROD env, this makes more difficult to know that app is running Symfony. app.php is widely known as our default front controller. It is a small effort by security through obscurity. For Apache, this 301 must be replaced by 404: https://github.com/symfony/symfony-standard/blob/77ee2a83c085169e0bd221510b5693dca504f682/web/.htaccess#L37 [Best Practices] removed unused link in business-logic Add missing space in code [Config] Complete security encoder in full default configuration [reference][configuration][security]Added key_length for pbkdf2 encoder Fixed typo Reworded a misleading Doctrine explanation
For Nginx in PROD env, this makes more difficult to know that app is running Symfony.
app.php is widely known as our default front controller.
It is a small effort by security through obscurity.
For Apache, this 301 must be replaced by 404.