So according to the README, the purpose of this file is to implement the PHP built-in webserver.

However, when you open the file, you can see the following from line 35:

 * Caution, this is very experimental stuff
 * no guarantee for working result
 * has tons of potential big security holes

That comment is kind of super scary and assuming that the setup host point to / instead of /pub that file can easily be accessible by adding /phpserver/router.php

So here are my questions:

  • what are the risks of keeping that file unprotected ?
  • is there any evident security holes as stated in the comment ?
  • why would Magento ship a software with such a file if it's super experimental ?

1 Answer 1


Provided you aren't running your live site with the built in php server (which would be pretty mad) there should be no risks to keeping this unprotected and no security holes in your live environment. The contents of the file is wrapped in a check of the SAPI, which means it shouldn't do anything unless accessed via the PHP built in cli server.

Given that you'd have to go out of your way to trigger it, I don't personally see an issue with Magento including an experimental feature that (in-theory) makes it easier for developers to quickly get M2 up and running to test things locally. I've spoken with other people that think it's bad to include such 'bad practices', but you could argue the same about most developer targeted features such as enabling display_errors. So long as it's secure in a 'default' environment I have no issues with such features.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.