PHP: an example where allow_url_include is a good idea?

Question

I just noticed a PHP config parameter called allow_url_include, which allows you to include a PHP file hosted elsewhere as you would a locally. This seems like a bad idea, but "why is this bad" is too easy a question.

So, my question: When would this actually be a good option? When it would actually be the best solution to some problem?

Answer 1

Hmm...

[insert barrel scraping noise here]

...you could use this is a means of licensing software - in that the license key, etc. could be stored on the remote system (managed by the seller). By doing this, the seller would retain control of all the systems attempting to access the key.

However, as you say the list of reasons this is a horrifying idea outweigh any positives in my mind.

Answer 2

Here is one example that I can think of.

At my organization my division is responsible for both the intranet and internet site. Because we are using two different servers and in our case two different subdomains then I could see a case for having a single library that is used by both servers. This would allow both servers to use the same class. This wouldn't be a security problem because you have complete control over both servers and would be better than trying to maintain two versions of the same class.

Since you have control over the servers, and because having an external facing server and internal server requires seperation (because of the firewall) then, this would be a better solution than trying to keep a copy of the same class in two locations.

Answer 3

Contrary to the other responders here, I'm going to go with "No". I can't think of any situation where this would make a good idea.

Some quick responses to the other ideas:

• Licensing : would be very easy to circumvent
• Single library for multiple servers: I'm sorry but this is a very dumb solution to something that should be solved by syncing files from for example a
  • sourcecontrol system
  • packaging / distribution system
  • build system
  • or a remote filesystem. NFS was mentioned
• Remote library from google: nobody has a benefit to a slow non-caching PHP library loading over PHP. This is not (asynchronous) javascript

I think I covered all of them..

Now..

your question was about 'including a file hosted elsewhere', which I think you should never attempt. However, there are uses for allow_url_include. This setting covers more than just http://. It also covers user-defined protocol handlers, and I believe even phar://. For these there a quite a bit of valid uses.