7

I was recently contacted by a client to evaluate their Magento store. I realized that the store (even though running in production) had developer mode enabled in their index.php file:

if (isset($_SERVER['MAGE_IS_DEVELOPER_MODE'])) { //the variable is set.
    Mage::setIsDeveloperMode(true);
}

They've been running this store in production for over 2 years. I restored the earliest revision of the file which was from 2013-02-09 and it still had developer mode set to true.

After reading this article by Alan Storm: PHP Error Handling and Magento Developer Mode I can't really think of a reason to recommend that the client disabled developer mode.

Are there any detrimental aspects of having it enabled in production?

Alan Storm's wrap-up:

Developer Mode will help you write cleaner code without subjecting your users to awkward PHP errors when something goes wrong

Seems pretty positive for me. As a rule of thumb, I previously just didn't subject production environment to developer mode.

  • 3
    in production mode, developer mode should be off. Otherwise small php notice errors will also get show in frontend. If developer mode is off,then user frontly errors only show in frontend and detailed php errors/notices/warning will get logged. – Rajeev K Tomy Apr 1 '15 at 6:39
  • 2
    I may be missing something here, but what you've listed is in default core Magento for index.php - so of course an earlier version of this file has the same block of code in it. You're seeing an "IF" statement to turn developer mode on (off by default). Do they actually have the environment variable set at vhost level or within the .htaccess? If they don't have the $_SERVER variable set, developer mode isn't enabled... – Douglas Radburn Apr 1 '15 at 11:32
  • Ah, sorry :) The variable is set. – Moose Apr 1 '15 at 11:45
8

Most developers tend to immediately respond saying it is a bad thing to have developer mode turned on on a production server as if this is a true fact. I think this is different per situation/webshop.

What happens when you turn developer mode on?

  1. mageCoreErrorHandler() will throw all errors instead of logging them
  2. Magento will throw errors in certain situations where it would normally silently ignore this fault and continue
  3. Mage::log() will always write to log even if logging is turned off
  4. Exception printing will display the code trace on screen instead of showing an error report page
  5. Other minor things in ignore skipping module updates, enterprise page cache, ....

Is this bad on a production server?

  1. Your website visitors could end up will all sorts of gibberish which could confuse them and therefor could have a negative impact on your websites conversion
  2. See no. 1
  3. On a production server you would more likely have a lot more page views than on a testing server. This might mean that if you have logging turned on (or developer mode turned on) your logs could be flooded.
  4. This is the one that could be harmful. If your exception traces get printed, then they can contain specific information that can be valuable to people with bad intentions.
  5. ...

On these 5 points, I could say they depend highly on the situation of your live website. What is your audience? Do they get frightened and run away when seeing PHP exceptions and traces? How many page views does your site have? What information could be leaked with dumping backtraces?

When reading all of the above, one could generally say it is not advised to turn on developer mode on a production server "as a rule of thumb" ;).

But is it a 'bad thing' per se? ...

  • I'd say, number 4 (and also 1) makes it a bad thing, without ifs and buts, simply for security reasons. – Fabian Schmengler Aug 17 '16 at 10:15
  • How can i enable developer mode for only my IP address? – zus Mar 3 '18 at 3:58
3

It is too harmful to enable developer mode on a production server because anyone can see your site's errors and system folder path. Lot of system details are printed to the browser screen and that makes it very harmful for your site.

It will be good idea to enable for developer code for specific ips.Just putting condition at index.php

$clientIp = $_SERVER['REMOTE_ADDR'];

if (isset($_SERVER['MAGE_IS_DEVELOPER_MODE']) && ($clientIp == '123.123.123.123')) {
    Mage::setIsDeveloperMode(true);
} 

This would enable developer mode only for the IP of a developer.

Disadvantage of enable developer

Customer Traffic: customer become irritate because of site print Error and don't goto not any next page.That make site bounce rate high.

Business: for high bounce rate site Business goes to down.

Site Speed: site become slow for every time log printed on system.log and exception.log.

solution

Solution is stage server.I am suggesting to

1.create: create stage

2.Dev Mode: enable all developer mode on stage system.

  1. Fix Error: Check the errors and will fix the code

  2. Upload Production: then upload fix code to product server.

  • Thanks Amit. Unfortunately all South African networks function via dynamic IP addresses (which change usually daily) as opposed to static IP addresses (which are constant). – Moose Apr 1 '15 at 7:23
  • 1
    @moose, you could try to match the $clientIp with an array (in_array($clientIp, array(/* IP's */))) or you could try to match a certain part of the IP with a bit mask. This is off topic for this SE and a bit too broad for this comment, so try to Google that. – 7ochem Apr 1 '15 at 8:04
  • 2
    7ochem ,you are good spell checker :) – Amit Bera Apr 1 '15 at 8:07
0

It is just wrong, all online literature on this topic is on how to edit the index.php file around "if (isset($_SERVER['MAGE_IS_DEVELOPER_MODE']). . ." line, while on the file info Magento recommends: "* Do not edit or add to this file if you wish to upgrade Magento to newer . . ."

The simple answer is that you must set or not the value of $_SERVER['MAGE_IS_DEVELOPER_MODE'] as apache or nginx directive.

For apache add this line on root .htaccess file if you want developer mode: SetEnv MAGE_IS_DEVELOPER_MODE true

For nginx edit this line on nginx.conf if you want developer mode: set $MAGE_MODE default; # or production or developer

(https://github.com/magento/magento2/blob/2.3-develop/nginx.conf.sample)

Root index.php file is a framework core file and must stay untouched.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.