PHP files and Security

[Frank Hagan]

I'm adapting a little PHP program I wrote for an Amazon associates store front. Amazon now requires you to pass a "public key" (20 characters) and a "secret key" (40 characters) that is encoded prior to passing it to them. Each user of the parent program has to register with Amazon to get both their public and secret key already so the users of my program are not inconvenienced by that. But the parent program encodes the keys in the database. Mine does not (in fact, it doesn't even use the database ... it just fetches X number of items from the Amazon database and links to the storefront.)

My little program simply has a variable for each key, and the user edits the file to include the plain text versions of their keys. This brings up a question, how secure is a PHP file from browsers? Surfing to the program simply runs it and you get the program's output. But is having the key in plain text in the program a security risk of some kind?

[djn]

A separate file containing the configuration and ending in .php would be interpreted by the server instead of being sent to the client. Such a file containing just a series of variables would give a blank page if called directly... unless the server admin (or you playing with .htaccess) breaks the PHP configuration (unlikely, but I managed to mess it via .htaccess once).

Better still, put that file in a subfolder and protect the whole folder via .htaccess with "order allow, deny / deny from all". Thus a mishap would require both breaking PHP and disabling .htaccess with an 'Allow Override none' (yet more unlikely).

Definitely the most fool-proof way woluld be to to include() that data from a file placed outside/above the server root. This would make it pretty much unreachable thru the web server.

[ZYV]

Definitely the most fool-proof way woluld be to to include() that data from a file placed outside/above the server root. This would make it pretty much unreachable thru the web server.

I'd like to second that. This is the way I usually proceed. But in fact, bear in mind that nothing will help if you have an open file inclusion hole in your script, so it's definitively not the magic bullet.

[Frank Hagan]

I'm not sure the users of this script would understand putting a file outside of the public_html folder, but I may try that. Maybe I can offer installation service (I'll charge $5,000 for a freeware program, that's the ticket).

There are many PHP scripts that have the username and password in a config.php file in plain text. Wordpress does this, as do all the forums I know of. That config.php file resides in a folder accessible by a browser in theory, although because there's no html in the file you don't get anything served to you. I'm wondering if there's any other security needed.

I did find out that the Amazon "secret key" is used only to access the advertising API, and cannot be used to access the owner's Amazon account or any other thing at Amazon. So the worst thing that could happen should the key be stolen is that the key would be suspended due to too many inquiries.

[djn]

I like your ticket's pricing! :-) For that money I'd throw in a free favicon and maybe Google Analytics...

As for the browser-reachable config, my current practice (if I really can't move it out of the root) is to put the thing in a folder of its own, block access via .htaccess and put in there a blank index.htm to prevent file listing. 'Defense in depth', I believe it's called: assume your first line of defense will fail somehow and have another showstopper ready when it does.

Earlier this year I had to harden up a Wordpress site that has been hacked into. I found that WP natively looks for the config file above the root if it doesn't find it in the root folder. Most of the plugins did, too (well, actually just one failed to behave).