search

perftools / xhgui

Web interface for XHProf profiling data can store data in MongoDB or PDO database
1.65k stars 343 forks source link

Document how to operate a public XHGui instance #308

Open Krinkle opened 4 years ago

Krinkle commented 4 years ago

The /import and /delete endpoints are something you generally don't want to leave exposed to the Internet. At Wikimedia, we've turned these off at the web server layer hoping that it can't be bypassed.

That suffices for now, but I'd like to either integrate this into the software, or embrace it as the recommended practice and advertise/document it here so that other people can learn from it, and also so that it will be taken into account when making changes in the future.

glensc commented 4 years ago

I think as first step these endpoints should be disabled by default and enabled only when someone explicitly enables them in config or at least restricted to 127.0.0.1 address by default.