Switch basic auth to .htaccess from PHP about beanstalk_console HOT 7 CLOSED

@EricTendian Any feedback?

from beanstalk_console.

@archon810 did you mean to tag me or someone else in your comment?

from beanstalk_console.

Oh I saw you pushed a PR for my previous ticket and figured you were a core committer. If not, I apologize.

Maybe @pentium10 is the right person then.

from beanstalk_console.

Assuming that your Apache is configured properly, there's nothing stopping you from disabling the HTTP basic auth set up by beanstalk_console and using .htaccess instead. (I'm considering doing so for a different reason - so that the people on my team can have their own passwords rather than a shared password, and so it can be stored in the hashed versions used by htpasswd rather than plaintext in config.php.)

The specific security issue you brought up (being able to access sensitive non-PHP files like storage.json) is not an issue if you set this up properly. beanstalk_console itself should not be within your public web directory; you should be symlinking from the web directory to beanstalk_console/public. The only thing visible by an attacker is the actual contents of the public directory. This is standard for PHP applications, but probably should be better documented in the readme.

from beanstalk_console.

Yeah, I ended up disabling the PHP file security and adding a .htaccess. You're probably right about /public, but I wasn't sure it was even going to work like that if I stick beanstalk_console into project root/tools/beanstalk_console, then symlink project root/public/beanstalk_console to project root/tools/beanstalk_console/public since the files in project root/public/beanstalk_console would potentially not have access to the right files in .. (.. would become project root/public/).

from beanstalk_console.

Assuming your Apache DocumentRoot is project root/public, that approach should work. When it accesses ../lib or whatever, it is relative to the "real" path not the symlinked path.

from beanstalk_console.

I am closing this as the package should not address all AuthType support for apache/nginx or others. Also there are no critical non PHP files in the /public folder, so people cannot directly access by link sensitive content.

from beanstalk_console.