I like to see the server-side web application layer as independent as possible, from the OS, from the server software like (Apache, nginx, IIS, et cetera). In order to easily grab the application and deploy it on a newer system. That has advantages as well as risks.
In the example I will use a setup with Apache and PHP. When the new underlying OS or server software isn't configured properly (that's indeed another problem), the programming language, for example PHP might not be interpreted as code but as text. Therefor if all the source-code is in a public folder (and the file-folder structure is known), the source-code leaks. Several solutions come to mind:
- move all (except one) PHP file(s) out of the public folder so that if it happens only one file (with includes only) is leaked and not the whole source-code;
- detect if the underlying system such as Apache supports PHP, for example in
.htaccess(since that ships with the application) and deny access to everything when PHP isn't supported/enabled. I once asked a question about that here: https://stackoverflow.com/questions/39450760/how-to-check-in-htaccess-if-php-is-enabled.
Such methods are easy to use and improve the concept of layered security. Since if the underlying layer fails, the application can still fallback in it's own deny state. Preventing in this case source-code leakage.
I like to know if there are other methods for the purpose of preventing source-code leakage. For example in a web-application firewall or proxy that detects source-code patterns or different practical configuration approaches.