One of my modules does some CURLing, and to do this it creates a cookie on the Drupal server. Where should I locate this? Where it will be nice and safe? Is there a convention? Is sites/default/files considered safe?
Add a comment
|
2 Answers
The risk depends on the nature of the cookie. If these cookies contain session data, they could be used to take over you session, which is considered to be high risk.
Your public files folder (sites/default/files) has public read access, meaning that everybody can obtain a file (once they know its name) by going to example.com/sites/default/files/[FILENAME]. This is not safe and perhaps not the best solution for the type of cookies described above.
Instead, you can save it to the private filesystem. Instructions for Drupal 7 and 8 differ, so best to look up the instructions you need. The ultimate safe solution would be to move your private filesystem outside of your webroot (some tutorials create it as subfolder of sites/default/files). Safer would be to place it in a folder next to your public_html/www folder or anywhere else on the filesystem, where it is not accessible from the internet.
If you configure it properly on SITE/admin/config/media/file-system, you can then use the streamwrapper private:// to read and write the files.
If these cookies do not contain any data that could be considered to be sensitive, sites/default/files (or public://) should be good enough.
answered Jul 8, 2017 at 22:44
-
Hi @Neograph734, but my question is, where on the file system? This is for Drupal 7. E.g., should they go in /var, /usr etc– JohnFFJul 10, 2017 at 21:07
-
No, your question was if you could put them in
/sites/default/files. There is no real convention for outside your webroot. Some people create a directory next to the public_html / www folders, others arrange it differenly within the filesystem. As long as the folder is owned by by your webserver (just like public files folder) and you provide full system path to Drupal you should be fine. Jul 10, 2017 at 21:18 -
Thanks, if you add that as an answer I will accept it and give you points.– JohnFFJul 11, 2017 at 12:00
-
@Neograph734 is quite correct about public/private files.
Another option would be in a database field.
What should be considered is how to distinguish authorized cookie access (intended use) from unauthorized use. In other words, is php running with a Drupal-authenticated session before it needs to access the cookie? If so, private files, DB etc are useful, but if 'anyone' can cause the server's php to run the curl processing, how is safety ensured?
