I like to see the server-side web application layer as independent as possible, from the OS, from the server software like (Apache, nginx, IIS, et cetera). In order to easily grab the application and deploy it on a newer system. That has advantages as well as risks.

In the example I will use a setup with Apache and PHP. When the new underlying OS or server software isn't configured properly (that's indeed another problem), the programming language, for example PHP might not be interpreted as code but as text. Therefor if all the source-code is in a public folder (and the file-folder structure is known), the source-code leaks. Several solutions come to mind:

  • move all (except one) PHP file(s) out of the public folder so that if it happens only one file (with includes only) is leaked and not the whole source-code;
  • detect if the underlying system such as Apache supports PHP, for example in .htaccess (since that ships with the application) and deny access to everything when PHP isn't supported/enabled. I once asked a question about that here: https://stackoverflow.com/questions/39450760/how-to-check-in-htaccess-if-php-is-enabled.

Such methods are easy to use and improve the concept of layered security. Since if the underlying layer fails, the application can still fallback in it's own deny state. Preventing in this case source-code leakage.

I like to know if there are other methods for the purpose of preventing source-code leakage. For example in a web-application firewall or proxy that detects source-code patterns or different practical configuration approaches.

  • 2
    The classic one, which is especially common with Wordpress based brochureware sites, is to upload a static version of the site, obtained by effectively saving the rendered pages from an offline server. You lose the editing tools on the live version, and can't make use of DB functions (e.g. search), but it can still be suitable sometimes. Not a general solution though. – Matthew Jun 20 '17 at 8:14

Your first solution is the correct one - have an entrypoint file which doesn't contain anything confidential but bootstraps the environment for the app and loads the code from a location unreachable by the web server - in fact that's how pretty much all web frameworks do it - PHP is the only one (to my knowledge) that persists with this stupid idea of putting the code in the web root folder and letting the web server handle URL routing.

  • Thanks for the answer. Are you aware of other methods except the described one? – Bob Ortiz Jul 7 '17 at 8:52
  • @KevinMorssink I doubt it - this method works so well that nobody thought of inventing something better. Again, this is a solved problem in pretty much all languages except PHP - and even in PHP you can solve it easily by not relying on the web server to handle URL routing (that involves a modern framework - check out Laravel for an example). – André Borie Jul 7 '17 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.