-
Notifications
You must be signed in to change notification settings - Fork 53
TWA 0404
"Possible environment file being served (maybe protected?) at: ${url}"
In the message output the variable ${url} is replaced by the URL of the environment file.
Files used to store Docker environment variables should not be published by the web server.
The web server sends not the content of the file but an error message "403 Forbidden". With this information a possible attacker knows that the file exists on the web server. The attacker gets the information that a Docker is used.
It is good to prevent serving the internal data files. A better protection is to hide the existence of the internal data files.
Current (August 2020) the twa script checks the files: '.env' and '.dockerenv'.
Configure the web server to not publish files with internal data. The web server should respond with "404 Not Found" or with a redirection to a standard error page.
There exists several configuration options to suppress files with name (pattern) in a blacklist or files not in whitelist. Search the web for examples.