From 11df0d595d6c7f58685c6c94f25c30839c5d474b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Malte=20H=C3=BCbner?= Date: Mon, 13 Jul 2026 16:14:23 +0200 Subject: [PATCH] security: disable Web Profiler and debug routes in prod Two reinforcing misconfigurations exposed the Symfony Web Profiler (/_profiler, /_wdt) in the prod environment: 1. config/bundles.php enabled WebProfilerBundle for 'prod'. Restricted it to 'dev'/'test' (the Symfony default). 2. config/routes.yaml directory-imports config/routing/ recursively, which loaded config/routing/dev/web_profiler.yaml without a when@dev guard. Removed that file; the correctly guarded config/routes/web_profiler.yaml (auto-loaded per env by MicroKernelTrait) already provides these routes in dev only. Verified: `debug:router --env=prod` now lists 0 _profiler/_wdt routes, while --env=dev still lists them. Co-Authored-By: Claude Opus 4.8 (1M context) --- config/bundles.php | 2 +- config/routing/dev/web_profiler.yaml | 7 ------- 2 files changed, 1 insertion(+), 8 deletions(-) delete mode 100644 config/routing/dev/web_profiler.yaml diff --git a/config/bundles.php b/config/bundles.php index 43b2b91d..4382de6f 100644 --- a/config/bundles.php +++ b/config/bundles.php @@ -5,7 +5,7 @@ Symfony\Bundle\MonologBundle\MonologBundle::class => ['all' => true], Doctrine\Bundle\DoctrineBundle\DoctrineBundle::class => ['all' => true], Doctrine\Bundle\MigrationsBundle\DoctrineMigrationsBundle::class => ['all' => true], - Symfony\Bundle\WebProfilerBundle\WebProfilerBundle::class => ['prod' => true, 'dev' => true, 'test' => true], + Symfony\Bundle\WebProfilerBundle\WebProfilerBundle::class => ['dev' => true, 'test' => true], Symfony\Bundle\TwigBundle\TwigBundle::class => ['all' => true], Symfony\Bundle\DebugBundle\DebugBundle::class => ['dev' => true], Symfony\Bundle\MakerBundle\MakerBundle::class => ['dev' => true], diff --git a/config/routing/dev/web_profiler.yaml b/config/routing/dev/web_profiler.yaml deleted file mode 100644 index f64ec5bd..00000000 --- a/config/routing/dev/web_profiler.yaml +++ /dev/null @@ -1,7 +0,0 @@ -web_profiler_wdt: - resource: '@WebProfilerBundle/Resources/config/routing/wdt.php' - prefix: /_wdt - -web_profiler_profiler: - resource: '@WebProfilerBundle/Resources/config/routing/profiler.php' - prefix: /_profiler