4 ms·

Upping this. If you hit a 404 page it seems a ton of your server side source code is visible.

• ceejayoz 5y ago
  The code revealed there is basically all open source Laravel framework stuff, but yeah, having APP_DEBUG=true turned on has potential to expose other more meaningful vulnerabilities.
  • jer0me 5y ago
    It also offers some performance benefits IIRC
    • chrismorgan 5y ago
      I’m guessing it’s also the cause of the JavaScript using inline source maps, meaning that it’s shipping over 2MB to do⸺ I think it’s currently literally nothing but the click handler to expand the FAQs (which would be better not collapsed in the first place, or failing that, implemented with the <details> element).
      • ceejayoz 5y ago
        No, that's (typically; in the default setup, at the very least; you could manage to make them related but it'd be a bit silly and take specific efforts) independent of APP_DEBUG.
  • dachryn 5y ago
    the real danger is that app_debug does less security checks in the middleware layers.