4 ms·
I don't know much about Laravel or Symfony, but your error pages show a full stack trace with the source code of the PHP files. Might want to turn that off.
by amanzi 5y ago
I don't know much about Laravel or Symfony, but your error pages show a full stack trace with the source code of the PHP files. Might want to turn that off.
- jc_811 5y agoUpping this. If you hit a 404 page it seems a ton of your server side source code is visible.
- ceejayoz 5y agoThe code revealed there is basically all open source Laravel framework stuff, but yeah, having APP_DEBUG=true turned on has potential to expose other more meaningful vulnerabilities.
- jer0me 5y agoIt also offers some performance benefits IIRC
- chrismorgan 5y agoI’m guessing it’s also the cause of the JavaScript using inline source maps, meaning that it’s shipping over 2MB to do⸺ I think it’s currently literally nothing but the click handler to expand the FAQs (which would be better not collapsed in the first place, or failing that, implemented with the <details> element).
- ceejayoz 5y agoNo, that's (typically; in the default setup, at the very least; you could manage to make them related but it'd be a bit silly and take specific efforts) independent of APP_DEBUG.
- dachryn 5y agothe real danger is that app_debug does less security checks in the middleware layers.
- gigamick 5y agoHey thanks for this. Yeah I'm a bit cowboyish in that regard haha. I'll turnout off when I go to put it out into the world for real. For now I'm really appreciating the feedback I'm getting (only started working on this 4 nights ago).
- samwillis 5y agoI understand the motivation to keep it in debug when you first put it online, but the HN community is rightly quite hawkish on this type of thing, it is a potentially massive security risk. If your hope is that you could gain some initial customers from here, it will almost certainly put a significant number off of giving it a go. I know you are super early with a MVP but as you are asking people to consider paying you already, I hope you reconsider.
- justinholmes 5y agoExactly won't be long before his Stripe environment variables are leaked through the debug error message.
- gigamick 5y agoHonestly, not looking for users - I'm looking for feedback, which I'm getting by the bucketload and it is amazing!
- justinholmes 5y agoAlso running on single VM in a GCP zone is a disaster waiting to happen.
- stavros 5y agoWhy? I've been running services on single instances for 13 years and it's been ok. Not everything has to be webscale.
- justinholmes 5y agoIt's not about being webscale it's about being professional.
- gigamick 5y agoDebug turned off :-)