Is it safe to leave debug=>true ?

selcukahmet

Sorry for basic question but I'm newbie on these laravel things... So is it safe to leave true on config file?

Zeokat

Safe when? When you use Flarum in production?

It can exposes some data an my advice is not use in production but... let the experts talk.

selcukahmet

Zeokat actually yes on production use

Zeokat

selcukahmet My advice is not use it in production. It's a bad security practice.

jordanjay29

I believe it can expose database information if left on. Also, it can provide detailed information on your directory structure that can aid an attacker.

Best to leave if off if you're running a production forum and aren't encountering any errors. Once you have your board set up and working, turn debug off and leave it there unless you run into problems.

luceos

As a side note you can do something like this:

    'debug' => in_array(\Illuminate\Support\Arr::get($_SERVER, 'REMOTE_ADDRESS', ''), ['one.ip.you.use', 'another.ip.you.use'])

This will enable debug only for the IP addresses you configure. Please note you might need to leave the array empty [] until you actually need this functionality when you don't have a fixed IP.