.ENV file is visible

Question

I am using Laravel 5.1

I recently uploaded my project in shared hosting. but when i browse http://siteAddress.com/local/.env my .env file is visible.

Is there any way to hide this file or redirect people if they want browse the site with folder view?

Mercurio

Sound like a missing .htaccess file. – Drabbet

I have a .htaccess file in root. And it's working. @Drabbet – Mercurio

Answer 1

Finally I hide .env and disable index view of the folder named local. I create a .htaccess in folder local.

And here is the code of .htaccess

# Disable index view
Options -Indexes

# Hide a specific file
<Files .env>
    Order allow,deny
    Deny from all
</Files>

Mercurio

Now go through all the other files you exposed by doing this and add them to your .htaccess file so they can't be accessed. – Acanthous

For those who're looking similar things, It's better to match every dot file with a sentence replacing <Files .env> with <FilesMatch "^\.env">..the same...</FilesMatch> this way you'll protect .env, .env-dev .any just in case... anyway dot env files are supposed to be hidden at least in Linux – Player

Answer 2

Please create a .htaccess file where you have .env file and write the code as shown below:

# STRONG HTACCESS PROTECTION
<Files ~ "^.*\.([Ee][Nn][Vv])">
 order allow,deny
 deny from all
 satisfy all
</Files>

Then try to hit the .env file from url and it will not be available and show codes inside.

If you want to remove it from github.

Please create new file .gitignore on the same directory.

and add line

.env

Monteria

Brave Can you confirm if this regex would work to also capture .env files that are named .env.test or .env.development.local for example? If not can you show me the right way to do it? Thanks. <Files ~ "^.*\.([Ee][Nn][Vv])*\.*"> order allow,deny deny from all satisfy all </Files> – Crossroad

hmm, does not work for me. Does this has to be within any other directive? – Straightjacket

Answer 3

You can add below code in .htaccess file to disable directory listing and restrict access of .env file:

# Disable Directory listing
Options -Indexes

# block files which needs to be hidden, specify .example extension of the file
<Files ~ "\.(env|json|config.js|md|gitignore|gitattributes|lock)$">
    Order allow,deny
    Deny from all
</Files>

Zincograph

Answer 4

The .env file resides outside the public folder so it should not be visible from outside world if the server is configured to see the public folder as document root.

From the best answer:

Remember that once your server is configured to see the public folder as the document root, no one can view the files that one level down that folder, which means that your .env file is already protected, as well your entire application. - That is the reason the public folder is there, security. - The only directories that you can see in your browser if you set the document root to the public folder is the folders that are there, like the styles and scripts.

https://laracasts.com/discuss/channels/general-discussion/how-do-you-protect-env-file-from-public

Check the folder structure on your hosting and make sure the public folder is the document root.

Chivalry

there is no public folder in my project. i move all files from public folder to root and move others files and folders in another folder named local (created by me). @Glad To Help – Mercurio

@smartrahat, you are doing wrong. You has converted your root folder in a public folder exposing all sensitive data – Scolopendrid

@manix, i did it to get rid of /public after my site address. is there any way to protect them with current file structure? – Mercurio

@smartrahat, I am afraid that you are really doing it wrong - it is not protected because it is not meant to be used the way you want it to. While in theory perhaps you could do it with htaccess what you should really do is either talk to your host to help you set up the structure properly or get a host where you have more control over things. – Chivalry

@GladToHelp he is not doing it wrong IF on shared hosting which to me it seems he is: you have to do it this way if using root domain, otherwise how would you point your main domain to a subfolder (public) on Cpanel? You cannot. – Straightjacket