Is plain text in index.html secure? Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) 2019 Community Moderator Election Results Why I closed the “Why is Kali so hard” questionUse wpa_supplicant without plain text passwordsHow to guarantee the integrity of an OS?Which linux distro's package repositories are secure and which are not?execute file in server more safely?Why does SSH have unsecure defaults?Why are custom programs always installed in /opt, /srv, /usr/local, etc. and not in ~/ (home) folder?Why thepiratebay.se showing the content of /var/www/index.html?How can I set up a secure LAMP stack on CentOS?Limiting Scope of File Writing by PHP ScriptWhat do I need to create backups as reliable and secured archives?
Why aren't air breathing engines used as small first stages
Withdrew £2800, but only £2000 shows as withdrawn on online banking; what are my obligations?
What would be the ideal power source for a cybernetic eye?
Why are there no cargo aircraft with "flying wing" design?
If 'B is more likely given A', then 'A is more likely given B'
Is there a concise way to say "all of the X, one of each"?
Antler Helmet: Can it work?
Stars Make Stars
Is above average number of years spent on PhD considered a red flag in future academia or industry positions?
"Seemed to had" is it correct?
Bonus calculation: Am I making a mountain out of a molehill?
Letter Boxed validator
Is the Standard Deduction better than Itemized when both are the same amount?
What is the correct way to use the pinch test for dehydration?
I am not a queen, who am I?
Diagram with tikz
do i need a schengen visa for a direct flight to amsterdam?
What does '1 unit of lemon juice' mean in a grandma's drink recipe?
How much radiation do nuclear physics experiments expose researchers to nowadays?
How can I make names more distinctive without making them longer?
Do you forfeit tax refunds/credits if you aren't required to and don't file by April 15?
Proof involving the spectral radius and the Jordan canonical form
List *all* the tuples!
What do you call a plan that's an alternative plan in case your initial plan fails?
Is plain text in index.html secure?
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern)
2019 Community Moderator Election Results
Why I closed the “Why is Kali so hard” questionUse wpa_supplicant without plain text passwordsHow to guarantee the integrity of an OS?Which linux distro's package repositories are secure and which are not?execute file in server more safely?Why does SSH have unsecure defaults?Why are custom programs always installed in /opt, /srv, /usr/local, etc. and not in ~/ (home) folder?Why thepiratebay.se showing the content of /var/www/index.html?How can I set up a secure LAMP stack on CentOS?Limiting Scope of File Writing by PHP ScriptWhat do I need to create backups as reliable and secured archives?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
So I would like to know if anybody can access my LAMP if I just write some plaintext in the index.html file, so that when somebody accesses my_ip:port they will be greeted to the text in that file.
I know everybody can read what's in that plaintext file, that's not my security concern.
My concern is whether or not somebody can run any scripts to affect my server or do anything because of it.
The reason I'm doing this is because I want an encrypted message to be visible on my lamp server, so that I can do some other stuff from there.
bash security apache-httpd
asked Apr 11 at 21:13
user323587user323587
592
add a comment |
So I would like to know if anybody can access my LAMP if I just write some plaintext in the index.html file, so that when somebody accesses my_ip:port they will be greeted to the text in that file.
I know everybody can read what's in that plaintext file, that's not my security concern.
My concern is whether or not somebody can run any scripts to affect my server or do anything because of it.
The reason I'm doing this is because I want an encrypted message to be visible on my lamp server, so that I can do some other stuff from there.
bash security apache-httpd
asked Apr 11 at 21:13
user323587user323587
592
2
I'd be more concerned about the M and the P parts of your LAMP stack, although Apache had a vulnerability recently, too.
– Jeff Schaller♦
Apr 11 at 22:35
add a comment |
So I would like to know if anybody can access my LAMP if I just write some plaintext in the index.html file, so that when somebody accesses my_ip:port they will be greeted to the text in that file.
I know everybody can read what's in that plaintext file, that's not my security concern.
My concern is whether or not somebody can run any scripts to affect my server or do anything because of it.
The reason I'm doing this is because I want an encrypted message to be visible on my lamp server, so that I can do some other stuff from there.
bash security apache-httpd
asked Apr 11 at 21:13
user323587user323587
592
So I would like to know if anybody can access my LAMP if I just write some plaintext in the index.html file, so that when somebody accesses my_ip:port they will be greeted to the text in that file.
I know everybody can read what's in that plaintext file, that's not my security concern.
My concern is whether or not somebody can run any scripts to affect my server or do anything because of it.
The reason I'm doing this is because I want an encrypted message to be visible on my lamp server, so that I can do some other stuff from there.
bash security apache-httpd
bash security apache-httpd
asked Apr 11 at 21:13
user323587user323587
592
asked Apr 11 at 21:13
user323587user323587
592
asked Apr 11 at 21:13
user323587user323587
592
asked Apr 11 at 21:13
user323587user323587
592
asked Apr 11 at 21:13
user323587user323587
592
592
2
I'd be more concerned about the M and the P parts of your LAMP stack, although Apache had a vulnerability recently, too.
– Jeff Schaller♦
Apr 11 at 22:35
add a comment |
2
I'd be more concerned about the M and the P parts of your LAMP stack, although Apache had a vulnerability recently, too.
– Jeff Schaller♦
Apr 11 at 22:35
2
2
I'd be more concerned about the M and the P parts of your LAMP stack, although Apache had a vulnerability recently, too.
– Jeff Schaller♦
Apr 11 at 22:35
I'd be more concerned about the M and the P parts of your LAMP stack, although Apache had a vulnerability recently, too.
– Jeff Schaller♦
Apr 11 at 22:35
add a comment |
1 Answer
1
active
oldest
votes
Putting plain text into the file is no less (or more) secure than putting HTML there. As far as the server is concerned, HTML is plain text: what gets sent over the wire is exactly the <html>...</html> bits written in the file.
There may be other security issues in play for your scenario, but this isn't one of them.
I would, however, encourage adapting your web server configuration so that the file is served as text/plain instead of text/html for technical correctness, though the practical differences are pretty minimal (browsers will probably render it in fixed-width instead of variable).
answered Apr 11 at 23:02
Michael HomerMichael Homer
51k8141178
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f511998%2fis-plain-text-in-index-html-secure%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Putting plain text into the file is no less (or more) secure than putting HTML there. As far as the server is concerned, HTML is plain text: what gets sent over the wire is exactly the <html>...</html> bits written in the file.
There may be other security issues in play for your scenario, but this isn't one of them.
I would, however, encourage adapting your web server configuration so that the file is served as text/plain instead of text/html for technical correctness, though the practical differences are pretty minimal (browsers will probably render it in fixed-width instead of variable).
answered Apr 11 at 23:02
Michael HomerMichael Homer
51k8141178
add a comment |
Putting plain text into the file is no less (or more) secure than putting HTML there. As far as the server is concerned, HTML is plain text: what gets sent over the wire is exactly the <html>...</html> bits written in the file.
There may be other security issues in play for your scenario, but this isn't one of them.
I would, however, encourage adapting your web server configuration so that the file is served as text/plain instead of text/html for technical correctness, though the practical differences are pretty minimal (browsers will probably render it in fixed-width instead of variable).
answered Apr 11 at 23:02
Michael HomerMichael Homer
51k8141178
add a comment |
Putting plain text into the file is no less (or more) secure than putting HTML there. As far as the server is concerned, HTML is plain text: what gets sent over the wire is exactly the <html>...</html> bits written in the file.
There may be other security issues in play for your scenario, but this isn't one of them.
I would, however, encourage adapting your web server configuration so that the file is served as text/plain instead of text/html for technical correctness, though the practical differences are pretty minimal (browsers will probably render it in fixed-width instead of variable).
answered Apr 11 at 23:02
Michael HomerMichael Homer
51k8141178
Putting plain text into the file is no less (or more) secure than putting HTML there. As far as the server is concerned, HTML is plain text: what gets sent over the wire is exactly the <html>...</html> bits written in the file.
There may be other security issues in play for your scenario, but this isn't one of them.
I would, however, encourage adapting your web server configuration so that the file is served as text/plain instead of text/html for technical correctness, though the practical differences are pretty minimal (browsers will probably render it in fixed-width instead of variable).
answered Apr 11 at 23:02
Michael HomerMichael Homer
51k8141178
answered Apr 11 at 23:02
Michael HomerMichael Homer
51k8141178
answered Apr 11 at 23:02
Michael HomerMichael Homer
51k8141178
answered Apr 11 at 23:02
Michael HomerMichael Homer
51k8141178
51k8141178
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f511998%2fis-plain-text-in-index-html-secure%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
I'd be more concerned about the M and the P parts of your LAMP stack, although Apache had a vulnerability recently, too.
– Jeff Schaller♦
Apr 11 at 22:35