# FastCGI security question

**URL:** <https://www.ruby-forum.com/t/fastcgi-security-question/187442>\
**Category:** NGINX\
**Created:** [April 23, 2010, 8:42am UTC](https://www.ruby-forum.com/t/fastcgi-security-question/187442 "2010-04-23T08:42:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![JSSSSrSSSSme\_Loyet](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/ee59a6/32.png) [@JSSSSrSSSSme\_Loyet](https://www.ruby-forum.com/u/JSSSSrSSSSme_Loyet)\
**Post date:** [April 23, 2010, 8:42am UTC](https://www.ruby-forum.com/t/fastcgi-security-question/187442/1 "2010-04-23T08:42:41Z")

</div>

Hi guys,

I’m working on php-fpm and I had an idea for a new feature.

I’d like to pass fastcgi headers to php-fpm which will set some PHP  
ini defines. It’s the same as php\_value or php\_admin\_value from the  
php apache module. I imagine something like:

fastcgi\_param PHP\_INI\_VALUE “display\_errors=off”;  
fastcgi\_param PHP\_ADMIN\_INI\_VALUE “open\_basedir=/var/www:/tmp”;

Even if it sounds great, I wonder if it could be a security breach  
somehow. Is there a way a request can overwrite those parameters by  
forging a particular request ?

thx for your advices

++ Jerome

---

<div class="post-metadata">

**Author:** ![JSSSSrSSSSme\_Loyet](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/ee59a6/32.png) [@JSSSSrSSSSme\_Loyet](https://www.ruby-forum.com/u/JSSSSrSSSSme_Loyet)\
**Post date:** [April 23, 2010, 9:01am UTC](https://www.ruby-forum.com/t/fastcgi-security-question/187442/2 "2010-04-23T09:01:25Z")

</div>

On Fri, Apr 23, 2010 at 08:42:19AM +0200, Jérôme Loyet wrote:

> Even if it sounds great, I wonder if it could be a security breach  
> somehow. Is there a way a request can overwrite those parameters by  
> forging a particular request ?

No, requests headers are always prefixed with “HTTP\_” when they are  
passed  
to FastCGI.

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**