Re: CLI Web Server customization
| From: | Kevin Ingwersen | Date: | Wed, 06 Nov 2013 20:09:28 +0000 |
| Subject: | Re: CLI Web Server customization | ||
| References: | 1 2 3 4 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-70038@lists.php.net to get a copy of this message | ||
Hey!
Thank you all for your kind help, now I feel confident using the CLI HTTP server, and will very
surely be doing so now.
As for the note, I'd have some idea for it:
Note: Due to the CLI Web server's low security, as it's intention wasn't for the
internet or productive use, we would suggest you to use a more standard webserver such as Apache.
However you can use it inside a network or for local development, as security concerns may not be as
high in these areas (that is, if the IP the server is bound to is not publicy available).
Kind regards!
Am 06.11.2013 um 21:00 schrieb Yasuo Ohgaki <yohgaki@ohgaki.net>:
> Hi Adam,
>
> On Thu, Nov 7, 2013 at 1:45 AM, Adam Harvey <aharvey@php.net> wrote:
> My recollection of the discussion at the time was that part of the
> reasoning behind that note was security: the CLI server was a new
> piece of code, and the public Internet is a pretty hostile place,
> particularly for Web servers. Therefore the intention was to
> discourage users from exposing the CLI server on anything other than
> loopback and private networks.
>
> It doesn't sound like that's a problem for Kevin, but I'm pretty sure
> that was part of the context there.
>
> I agree.
>
> There was security issue in cli server in fact.
> Current documentation is too much. IMHO.
> It may be good time to modify our doc a little.
>
> Any objection for making security warning to a note
> that discourages use under internet?
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net