Debug output in production #

This page is for administrators and developers. Debug reports show SQL, file paths, template names and timings: useful while developing, a map for an attacker on a public site (13.4 Debug output and error display).

Contents #

1. The safe defaults
2. Debugging a live problem
3. PHP itself
4. Checking
5. Related pages

The safe defaults #

settings/site.ini [DebugSettings] as shipped:

and [TemplateSettings] Debug=disabled (no template names in the HTML).

Debugging a live problem #

Only when you must, only for your own address, and remove it again the same day:

# settings/override/site.ini.append.php
[DebugSettings]
DebugOutput=enabled
DebugByIP=enabled
DebugIPList[]
DebugIPList[]=203.0.113.10

• Entries may be single addresses or CIDR ranges, IPv4 and IPv6; the debug bar documents labels and expiry dates on entries (The Exp Debug bar).
• DebugByIP trusts the address Exponential determines; behind a proxy it comes from a forwarded header only when the proxy is in TrustedProxies[]. A range wider than your proxies, or an entry for the proxy's own address, gives debug output to everyone.
• The debug bar's settings tab can change these values and needs setup/setup.
• Setting writes are recorded in the audit (system.setting.write), so a forgotten debug switch can be found: /audit/console/(name)/system.setting.write.

A safer alternative for many problems: find the error by its reference in the log viewer (Finding an error by its reference).

PHP itself #

In the php.ini of PHP-FPM: display_errors=Off, log_errors=On, expose_php=Off. Velocity ships display_errors=Off and log_errors=On for FrankenPHP; for the qbix engine add them to settings/override/velocity.ini.append.php [PHPSettings] IniOptions[] if your CLI php.ini displays errors.

Checking #

./console exp:ini get site.ini/DebugSettings/DebugOutput --allow-root-user
curl -s https://www.example.gov/ | grep -i -c 'debug'          # from an address not in the list
curl -sI https://www.example.gov/ | grep -i x-powered-by        # nothing with expose_php=Off

Add DebugOutput=disabled to your go-live checklist and your monthly review.

Related pages #

• 13.4 Debug output and error display
• Security and audit, 4
• Proxies and trusted headers
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.