Laravel: How to protect .env files?

.env files:

If you develop your applications using Laravel, you probably use .env files every day in your development life. We use these files to store the most secret information of our application. Be it database credentials, the application key or any third-party service credentials.

So simply put: We do not want anyone to get access to these files!

But the truth is: quite a few .env files are accessible. And I don’t mean that they are accessible by some hackers, but by Google.

To search for public .env files, all you need to do is google for one of these terms:

DB_USERNAME filetype:env

DB_PASSWORD filetype:env

APP_DEBUG filetype:env

Secure your .env files

The reason that these .env files are accessible and also get scraped is because of two things:

Misconfigured shared hosting

The .env file has the wrong access rights

Shared hosting

If you use shared hosting, please make sure that the root folder of your Laravel application is not accessible from the outside.

Only “public” folder should be accessible from the webserver. If you cannot modify these settings on a shared hosting system, move to a VPS now.

Wrong .env access rights

Another possible issue could be, that your .env file simply has the wrong access rights.

Set the CHMOD of your .env file to 400 or 440 so that it cannot be accessed by public users.

These should all be quite obvious things, that you usually do not have to deal with — but since it comes up on Google, I thought it will be worth talking about this.

Comments

As a symfony developer what you should take care when symfony standard edition is legacy:

Now symfony standard edition is legacy . So no need to worry much just go threw article and understand whats new in symfony 4 if standard edition is legacy now. This is the main difference in Symfony 4 from symfony 2 and symfony 3 . Older symfony versions provide by default doctrine, twig, form, validation, profiler, annotations and many other components. But some time user do not want to use it. Suppose what if user do not want to doctrine or twig? Still he has doctrine and twig in his dependency. That makes symfony heavy framework. When starting a new project developers do not like to assemble things manually. So symfony 2 and 3 provides standard edition for developers to start a big project. But was hard to scale down project and decrease dependency if user do not require some packages. Symfony 2 and 3 are big success and in years developers are now aware with composer and dependency injection. So adding/removing a new package is not a big deal. So symfony chose...

Learn Angular 4 from scratch

Angular 4 is the latest version of AngularJs released in March 2017. The basic steps to accomplish our first Angular 4 hello world example. Here, we’ll simply create a component that passes the title from component to the view. 1. Install Angular CLI The Angular CLI is a command line interface that helps to scaffold and build angular apps in Node.js style. Also, it set up the angular 4 environments and will be helpful for us to work with angular apps like creating, running, etc. Now, install Angular-CLI. <code>npm install -g angular-cli</code> Once installation is done, just make sure that it’s installed by checking it’s version. <code>ng -v</code> 2. Install an Angular 4 Hello World App Here, we will create an app named hello-world ng new hello-world Now, go to the directory of a newly created project. cd hello-world Before running your app, let’s dive a bit deeper in coding behind the picture. 2.1 Fi...

3 Node.js Alternatives To WordPress

3 Node.js Alternatives To WordPress As compare to WordPress there is alternative option like Node.js. There are many various latest challengers that have large communities, support themes, plugins and are easy to install on your own server. Here are 3 you might want to checkout. KeystoneJS KeystoneJS is a content management system and framework to build server applications that interact with a database. It is based on the Express framework for Node.js and uses MongoDB for data storage. It represents a CMS alternative for web developers who want to build a data-driven website but don’t want to get into the PHP platform or large systems like WordPress. EnduroJS Enduro.js offers a fast and easy way to build your project, beautiful and simple admin UI and integrated tools to build everything on the server. It works without a database, instead relying on a system of flat files that can be opened directly in a text editor. It is easy to install and can be deployed via Git. ...

Search This Blog