I understand that (at least on Linux servers) the custom is to create a ScriptAlias
from a cgi-bin
directory located inside the DocumentRoot
(i.e. /var/www/html/cgi-bin/
) to a cgi-bin
directory located outside of the DocumentRoot
(i.e. /usr/lib/cgi-bin/
etc.)
Is this required for security reasons, or is it safe to simply store and run a script (for example, a Perl script containing DBI credentials) in the original cgi-bin
of the DocumentRoot
? What would be required for this option to be just as secure?