A client has a 'hostile development environment' and, related to this, a list of 'blessed modules'.

One of the hard/fast rules is 'no Webform' module.

(The only answer given to 'Why?' so far is, "If the answer is Webform, you're asking the wrong question," by the Devops people who guard this hostile environment.)

Is this a justified exclusion in any way and how would you respond to this statement/exclusion?

Our use case is for a single, simple contact form which allows users to submit their email address, a Subject and a body (in plain text only).

And the reason I'm asking this is so I can explain to 'stakeholders' (also on the client side) what's going on. Devs on my side are mystified.

3 Answers 3


Coming from a huge production environment with Drupal multi-site running, the Webform can be a constant headache if there is no SPAM protection turned on, or if modules/core aren't kept up-to-date. Maybe they had problems in the past with Drupal admins not running protection on their forms and not keeping their modules up-to-date with the latest security fixes? Also, Drupal, the Webform module and open-source CMSs in general have a bad rap with the IT/Security crowd. I have experience it more than once in my career.

The best thing you can do is find out why they feel the way they feel about that particular module, and then explain to them how, if maintained correctly and used correctly, it should be of little to no concern.

  • Thanks! Tried this and no joy apart from 'it's bad'. Suspect it's more to do with them being 'IT' than anything else.
    – i4_1
    Jul 31, 2012 at 13:22
  • 1
    I wouldn't be so quick about blaming the problem on Mordac the Preventer of Information Services. I have a client who has had some serious grief with the Webform module, precisely with the reasons outlined in this answer.
    – mpdonadio
    Jul 31, 2012 at 13:45
  • @MPD - but isn't this a question of implementation rather than webform itself? And, therefore, could be true of any module? And it still leaves open the question of how else this functionality would be achieved - we're not seriously suggesting embedding mailto links within the page or not allowing users to contact site admins, for instance?
    – i4_1
    Aug 7, 2012 at 13:49
  • @i41, it's some of both. My client had a rough patch with bugs in the Webform module and updates that did not go well. IT departments are often saddled with supporting systems that they have little say over and also may have policies pushed down onto them. The best bet is to try to work with them to figure out what the alternates are.
    – mpdonadio
    Aug 7, 2012 at 14:31
  • They sound like very lazy security folks to me: rather than actually get to know how things work they just blacklist anything they've ever heard anything bad about. (Of course, being really good at security is much harder than being really good at development, because a tiny mistake can cost you big time. Imagine if a single bug could cost you your job.) Since doing security really well is so much work, it's easy to just say "that's bad: we don't allow it".
    – iconoclast
    Sep 28, 2012 at 18:39

The webform module has well over 200000 installs. Compared to any other Drupal-related way of gathering data, the module is very well vetted from a security perspective. Add that it's used on the professional webform.com site, and I don't see how anyone could complain about its security.

I've deployed webform to a customer that described it's environment as very hostile as well, their team didn't have any problems with it.

You need to get a serious answer, or a suggestion for an option. If you need to gather data, sure, you could implement it yourself, but then why not implement your own encryption-scheme while you are at it.

  • Thanks @Letharion - I've tried the suggestion for an option and will update here if I ever get one. (Doubt I will, though. It's been two weeks now.)
    – i4_1
    Aug 7, 2012 at 13:50

First of all I would want a clear explanation of why certain modules are restricted. May be they have found a security issue in it or sometimes some business units wants to store Personally Identifiable data in a secured manner. Once I get the explanation I will modify the module accordingly if its reasonable.

  • They won't give a reason, sadly. Seems like it's more like an attempt to eliminate risk (you can't have this!) than manage risk (you can have this, but you have to adhere to these standards). Thanks.
    – i4_1
    Jul 31, 2012 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.