Aimed on security: Debug mode
Foreword
I decided to write article about why you should never allow debug mode on you site in production environment. Why I am writing about post about crystal clear thing like this? Because recently I saw Symfony web site with debug mode accessed to everyone simply opening default path https://example.co.uk/app_dev.php
and I wished I was rather blind.
What attacked can get from debug mode?
All URL addresses
By opening non-existing URL you get full list of URL addresses. There can be addresses for testing purposes and/or forgotten ones maybe some old API calls. Of course this should not be in production... but be honest - who never make something quick and dirty?
Database structure
Examination of database structure is easy because all queries are logged. Except everyone see your table names and (if you are using doctrine1) all column names attacker cannot access to data. But database ins't something you want to expose if your project isn't open source... and everyone see how big amateur you are.
Getting sensitive information
Can attacker access to sensitive data? Well, it depends... let's try one example:
// src/Controller/PaymentController.php
class PaymentController extends Controller
{
public function paymentAction(Request $request, $amount)
{
$accessCode = $this->getParameter('secret_bank_code');
$payment = $this->get('blog.payment');
$payment->sendMoney($amount, self::MATOK_ACCOUNT, $accessCode);
return $this->render('Example::payment.html.twig');
}
}
... and payment service code:
// src/Payment/PaymentService.php
class Payment
{
public function __construct(/*...arguments... */)
{
// ...
}
public function sendMoney($amount, $receiver, $accessCode)
{
if ($amount <= 0) {
throw new \Exception('Amount is not valid!');
}
// ...
}
}
What if requirements for $amount
are not properly defined in routing? Anyone can pass anything and exception is raised. In production mode in can looks like this screenshot.
But in debug mode anyone can spot secret information. Well, this code is made in this way just for demonstration... but it's likely that visitor/attacker see something that should be confidential.
Conclusion
Debug mode is very dangerous. In no circumstances you reveal debug mode (doesn't matter what framework you are using) to public. How you hide it? It's your job. You can write me for help.
Footnotes:
1: by default Doctrine prints all column names
I'm foreigner. Where I live my friends call me Maťok.