Security Misconfiguration
debt(d5/e3/b3/t6)
Closest to 'specialist tool catches' (d5) — owasp-zap and lighthouse from detection_hints can find exposed phpinfo/debug pages, but standard CI/linters won't catch php.ini misconfigurations without dedicated scanning.
Closest to 'simple parameterised fix' (e3) — quick_fix is changing a handful of php.ini directives (display_errors=Off, expose_php=Off, disable_functions), a small config change rather than code refactor.
Closest to 'localised tax' (b3) — config lives in deploy/ops layer; once set correctly it doesn't reshape application code, though it requires ongoing audit discipline across environments.
Closest to 'serious trap' (t7) — the misconception field states developers treat this as an ops-only concern, so the 'obvious' assumption (someone else handles config) leads to defaults shipping to production; contradicts the dev-owns-security expectation.
Also Known As
TL;DR
Explanation
Security misconfiguration is consistently the most prevalent OWASP finding and encompasses: default credentials left unchanged, unnecessary features or services enabled, overly permissive cloud storage buckets, verbose error messages exposing stack traces, missing security headers, and unpatched software. In PHP, a hardened configuration disables display_errors in production, sets expose_php=Off, restricts open_basedir, disables dangerous functions, and keeps the runtime patched.
Common Misconception
Why It Matters
Common Mistakes
- Leaving APP_DEBUG=true or display_errors=On in production — stack traces reveal file paths, credentials, and logic.
- Using default credentials for databases, admin panels, or cloud consoles.
- Exposing .env, .git, or phpinfo() endpoints publicly.
- Not disabling unused PHP extensions and functions (exec, system, shell_exec) in production.
Code Examples
# Misconfigured production server:
php.ini:
display_errors = On # Stack traces to users
expose_php = On # Advertises PHP version
allow_url_include = On # Enables RFI
nginx:
autoindex on; # Directory listing enabled
server_tokens on; # Nginx version in headers
.env file readable via HTTP: # DB credentials exposed
APP_DEBUG=true # Debug mode in production; php.ini production hardening checklist
expose_php = Off ; hides X-Powered-By: PHP/8.x
display_errors = Off ; CRITICAL — never expose to users
log_errors = On
disable_functions = exec,shell_exec,system,passthru,proc_open
allow_url_fopen = Off
allow_url_include = Off
session.cookie_httponly = On
session.cookie_secure = On
session.use_strict_mode = On
; nginx — hide server version, disable directory listing
server_tokens off;
autoindex off;
; File permissions:
$ find /var/www -type f -exec chmod 644 {} \;
$ find /var/www -type d -exec chmod 755 {} \;
$ chmod 600 .env