Exposure of Sensitive Information Through Environmental Variables

# application.properties
# Load secrets from env vars (good practice)
db.password=${DB_PASSWORD}
aws.secret.key=${AWS_SECRET_ACCESS_KEY}

# DANGEROUS: Exposing all actuator endpoints without security.
management.endpoints.web.exposure.include=*
# management.endpoint.env.enabled=true (Default)
# If Spring Security is misconfigured or not applied to /actuator/**

# application-production.properties (Secure Actuator Config)
# Expose only health and info publicly
management.endpoints.web.exposure.include=health,info
# Expose others via a different port or path secured by Spring Security
# management.server.port=9090 # Example separate port
# management.endpoint.env.enabled=true # Keep enabled if needed for secured access

# Secure error handling
server.error.include-stacktrace=never
server.error.whitelabel.enabled=false

// config/SecurityConfig.java (Example securing Actuator)
// Add configuration to require ADMIN role for /actuator/** endpoints,
// potentially using a separate WebSecurityConfigurerAdapter with @Order.
@Configuration
@Order(1) // Example order
public class ActuatorSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.requestMatcher(EndpointRequest.toAnyEndpoint()) // Selects actuator endpoints
            .authorizeRequests()
                .requestMatchers(EndpointRequest.to("health", "info")).permitAll() // Allow health/info
                .anyRequest().hasRole("ACTUATOR_ADMIN") // Secure others
            .and()
            .httpBasic(); // Use basic auth for actuator access
    }
    // Configure users/authentication for ACTUATOR_ADMIN role separately
}

// Startup.cs - Configure()
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // DANGEROUS: If env is Development in production.
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage(); // Shows rich debug info
    } else { /* ... */ }
    // ...
}

// Some Service Constructor or Method
public MyService(IConfiguration config, ILogger<MyService> logger)
{
    // DANGEROUS: Logging the entire configuration tree,
    // which includes values from appsettings.json, environment variables, Key Vault etc.
    logger.LogDebug("Current Configuration: {ConfigSnapshot}", config.AsEnumerable());
    // ...
}

// Startup.cs - Configure() (Secure)
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    else
    {
        // SECURE: Use generic handler in production.
        app.UseExceptionHandler("/Home/Error");
        app.UseHsts();
    }
    // ...
}
// Ensure ASPNETCORE_ENVIRONMENT=Production

// Secure Logging Example
public MyService(IConfiguration config, ILogger<MyService> logger)
{
    // SECURE: Log only specific, non-sensitive config values if needed.
    var serviceUrl = config["ExternalService:Url"];
    logger.LogInformation("External Service URL configured: {ServiceUrl}", serviceUrl);
    // DO NOT log config["Db:Password"] or similar secrets.
}

# .env (Production)
APP_ENV=production
# DANGEROUS: Ignition error page will show .env contents and server variables.
APP_DEBUG=true

DB_PASSWORD=ProdDbPassword!
AWS_SECRET_ACCESS_KEY=ProdAwsSecretKey

// info.php (DANGEROUS if accessible on production server)
<?php
// This function outputs extensive information including all
// environment variables, PHP settings, server variables, etc.
phpinfo();
?>

# .env (Laravel Production - Secure)
APP_ENV=production
APP_DEBUG=false # SECURE
LOG_CHANNEL=stack
# Secrets are loaded but not exposed by debug screens
DB_PASSWORD=ProdDbPassword!
AWS_SECRET_ACCESS_KEY=ProdAwsSecretKey

# Nginx config (Secure - Deny access to dotfiles)
location ~ /\. {
    deny all;
}

# .htaccess or Apache config (Secure - Deny access to .env)
<Files .env>
    Require all denied
</Files>

// app.js (Error Handler)
const isProd = (process.env.NODE_ENV === 'production');

app.use((err, req, res, next) => {
    console.error(err); // Log server-side

    // DANGEROUS: Sending the whole process.env in development mode,
    // which might accidentally run in production if NODE_ENV isn't set correctly.
    res.status(err.status || 500).json({
        message: err.message,
        // Exposing all environment variables is risky even in dev, let alone prod.
        environment: isProd ? undefined : process.env
    });
});

// webpack.config.js (Example - Incorrect Usage)
const webpack = require('webpack');
// DANGEROUS: Directly embedding a sensitive server-side key into client bundle.
// Attacker can just view the source of the JS file.
module.exports = {
  // ... other config ...
  plugins: [
    new webpack.DefinePlugin({
      'process.env.API_SECRET': JSON.stringify(process.env.API_SECRET_SERVER_ONLY)
    })
  ]
};

// app.js (Secure Error Handler)
const isProd = (process.env.NODE_ENV === 'production');
app.use((err, req, res, next) => {
    console.error(err);
    res.status(err.status || 500).json({
         // SECURE: Send only a generic message in production.
         message: isProd ? "An error occurred." : err.message
         // NEVER send process.env
    });
});

// webpack.config.js / .env for frontend (Secure)
// Use framework conventions for exposing PUBLIC env vars only
// Example for Create React App / Vite:
// .env file:
// REACT_APP_API_BASE_URL=[https://api.example.com](https://api.example.com)
// VITE_API_BASE_URL=[https://api.example.com](https://api.example.com)
// SERVER_API_SECRET=keep_this_secret_on_server // NOT PREFIXED, NOT exposed to client

// Frontend code: Access only prefixed variables
// const apiUrl = process.env.REACT_APP_API_BASE_URL; // Or import.meta.env.VITE_API_BASE_URL

# config/environments/production.rb
# DANGEROUS: Shows detailed error page including request headers
# and potentially environment variables passed via CGI/Rack.
config.consider_all_requests_local = true

# app/controllers/debug_controller.rb
class DebugController < ApplicationController
  before_action :require_admin # Even if admin-only, logging ENV is risky

  def show_env
    # DANGEROUS: Displaying or logging all environment variables.
    @environment_variables = ENV.to_h
    Rails.logger.info "Current ENV: #{@environment_variables.inspect}" # Risky logging
    render :show_env # Assume view displays @environment_variables
  end
end

# config/environments/production.rb (Secure)
Rails.application.configure do
  # SECURE: Ensures generic public error pages are shown.
  config.consider_all_requests_local = false
  config.log_level = :info
end

# app/controllers/debug_controller.rb (Secure Logging)
class DebugController < ApplicationController
   before_action :require_admin

   def show_safe_config
     # SECURE: Only access/display specific, non-sensitive variables.
     @app_version = ENV['APP_VERSION']
     @deploy_env = ENV['DEPLOY_ENV']
     Rails.logger.info "Displaying safe config: Version=#{@app_version}, Env=#{@deploy_env}"
     render :show_safe_config # Assume view only uses these safe variables
   end
end