In CakePHP, Is there a safer way to store secrets in database.php and core.php?

Question

In CakePHP, database connection strings, salt, and encryption keys are stored in plain text. If someone physically steals the webserver, they can obtain access to the database that may be on the same machine. Is there a more secure way to store these values, for example, as environment variables that must be entered manually at boot time?

I have used dotenv to store some secrets out of the default directory but even these environment variables are in plain text on the same machine, just in a different directory (/etc/dotenv/.env).

Answer 1

"If someone physically steals the webserver"

your server should have encrypted hard-drives/ssds which should be unlocked when the server boots (you have to input the password manually everytime you (re-)boot of course). This will prevent anyone from simply reading your clear-text data when someone physically steals the server and puts your hard drives into another machine.

"In CakePHP, database connection strings, salt, and encryption keys are stored in plain text"

This is standard accross all major PHP frameworks. But the base premise is, that CakePHP relies on your server being secured beforehand so no one unauthorized can easily access the source files.

Even though these are stored as "plain-text" there is no easy way for any external web user to read those connection strings, salt, encryption keys etc. (if you have an updated PHP version, updated Server OS, no security issues in your app, correctly configured web server etc.)