在 php 文件中存储密钥
我在我的 php 应用程序中使用 Amazon Web 服务。将秘密 aws 访问令牌存储在链接到我的 php Web 服务的 config.php 文件中是否安全？
我无法下载该文件来查看内容，但是是否可以使用数据包嗅探器或其他东西来读取密钥和密码短语？
我知道 Amazon 建议使用令牌自动售货机来创建临时凭证，而不是直接使用 aws creds，但我们希望能够跳过实施这一过程。
I am using Amazon web services in my php application. Is it safe to store the secret aws access tokens in a config.php file that are linked to my php web service?
I have been unable to download the file to look at the content, but isn't it possible to use a packet sniffer or something and be able to read the key and pass phrase?
I know Amazon recommends using a token vending machine to create temporary credentials, instead of using the aws creds directly, but we are hoping to be able to skip implementing one.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
就“下载 PHP 文件”而言，Apache 会阻止这种情况发生，但您绝对应该将 PHP 文件存储在文档根目录之外，这样它首先就无法被 Web 访问（并在服务器端（如果需要）。
就“数据包嗅探”而言，安全连接可以防止这种情况发生。只需确保您使用的是 HTTPS。
In terms of "downloading the PHP file", Apache would prevent that from happening but you should definitely store the PHP file outside of the document root so it isn't accessible to the web in the first place (and require() it on the server side if needed).
In terms of "packet sniffing", secure connections prevent that from happening. Just make sure you're using HTTPS.
除非您的 config.php 文件在运行时输出令牌，否则您应该是安全的。为了采取额外的预防措施，您可以将 config.php 文件放在网站的根目录下，这样用户甚至无法尝试运行该文件。
您的 php 正在服务器上执行，只要没有将包含令牌的输出发送到客户端，该文件的内容就永远不会发送到客户端。因此，他们无法读取该文件，因为内容永远不会离开服务器，而只是运行脚本的输出。
Unless your config.php file will output the tokens when it is run, you should be safe. To take extra precaution, you could place the config.php file below the root directory of your website so that the user isn't even able to try to run that file.
Your php is being executed on the server, and as long as no output is being sent to the client that contains the tokens, the contents of that file will never be sent to the client. Therefore, they would have no way of reading the file because the contents never leave the server, just the output from running the script.
不。这是不可能的，因为脚本在将内容传递到客户端之前仅在服务器端运行。
唯一可能的漏洞是有人侵入服务器本身并从文件系统中窃取了文件。
No. It's not possible as the script runs on the server side only, before delivering the content to the client.
The only possible breach is if someone hacked into the server itself, and stole the file from the file system.
除了上述建议（将您的配置存储在网站的公共目录之外）之外，加密您的密码/秘密而不是将它们以纯文本形式存储在任何地方是一种很好的技术（特别是当使用非 php 文件来存储密码时，例如 < code>.env 或
*.yml等）。通过错误配置网络服务器、提交到 Github 等，很容易暴露易受攻击的数据。更多阅读：https://blog.fortrabbit.com/how-to-keep-a-secret
In addition to above recommendations (to store your configs outside of public directory of the website) it's a good technique to encrypt your passwords/secrets rather than store them as plain text anywhere (especially when using non-php files for storing passwords such as
.envor*.ymletc.). It's quite easy to expose vulnerable data by misconfiguration of webserver, commiting to Github etc.More reading on this: https://blog.fortrabbit.com/how-to-keep-a-secret