Storing Database Credentials in Cakephp 3.1 app.php file

Question

I'm putting the finishing touches on my cakephp project (configuring final database grants, etc) and realised something about cakephp.

From what I can tell (unless I inadvertently changed it), cakephp shipped with the app.php file permissions of -rw-rw-r-- (662).

Doesn't allowing anyone with access to the server the ability to see your database credentials pose a security risk?

Would it break things if I changed this to -rw-------? (600)

Answer 1

Totally depends on your configuration, there is no one correct way to do it, so -rw-rw-r-- aka 0664 is likely just fine. If your web server process runs under the same user that owns the files then -rw------- aka 0600 is ok. But generally, you want to ensure that the web server process does not have write permission to the files it serves . You can achieve this purely with file permissions but I prefer to make the user that runs the web server process different than the user that owns the files being served.