Add option to hide Environment Variables from all Globals
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
I am looking for a way to hide Environment Variables from $_SERVER or from all Global Arrays.
I would prefer to secure my environment variables as much as possible and make them explicit when using.
I only require getenv('my_env_var');
I do not want or need $_SERVER['my_env_var'] or $_ENV['my_env_var'].
There are many third-party tools and libraries that might expose $_SERVER in logs or debugging. Also if the code is compromised dumping $_SERVER is very easy. This could be mitigated by encrypting Environment Variables, but I would also like to make accessing them very explicit.
Currently I can set clear_env to yes and change variables_order to "GPCS" and ignore "E" to remove $_ENV, but I can't remove "S" as that is needed for REMOTE_ADDR, etc.
Changing clear_env does remove any server configured environment variables, but it still adds any environment variables being added from php-fpm config file when doing env[some_name] = some_value. I would need all those to be hidden from $_SERVER as well and only accessible via getenv().
It would be nice to have another php config option to do that and have that option accessible from php-fpm config as well like clear_env or variables_order
Maybe something like expose_env. Default is yes, but can be set to no.
no should remove it from $_SERVER as well as $_ENV or any other Global data.
Bonus points if no can also remove it from, errors, functions (like debug_backtrace), etc.
Thanks
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading how the existing clear_env and variables_order options populate $_SERVER and $_ENV, along with how php-fpm env[...] values are handled. Define the option's scope and verify that disabling exposure hides those values from global arrays while getenv() remains usable; the requested error and debug_backtrace behavior is an additional open question.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100