[Security][Proposal][WIP] Deny explicit requests to app.php/ #713
Conversation
Added check in app.php front controller in order to avoid explicit requests being served by PROD env, except while Apache mod_alias redirect fallback. Before: ``` GET http://localhost:8000/app.php/demo/hello/Fabien HTTP/1.0 200 OK ``` After: ``` GET http://localhost:8000/app.php/demo/hello/Fabien HTTP/1.0 404 Not found ``` | Q | A | ------------- | --- | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Doc PR |
|
|
|
If you prefer to get a 404 to not expose information about the framework, it should IMO also be done in the htaccess |
|
@Tobion, I can see that you're right about 301 in Apache. Right now I'm using Nginx with FPM. |
|
IMO, it is better to handle it in your webserver config |
|
@stof, what is your point about obscurity related to this PR (301 vs 404)? |
|
Closing this PR as we won't have anything specific to Apache in our PHP code. Indeed, updating the documentation would be much better. 404 looks best to me. |
|
Thank you @fabpot. |
Added check in app.php front controller in order to avoid explicit requests
being served by PROD env, except while Apache mod_alias redirect fallback.
Before:
After:
This approach tries to help with the obscurity about which framework is used in the app (app.php is publicly known as Symfony's front controller).
It's a proposal, any suggestion or comment are welcome.