Dusk: Exception: It is unsafe to run Dusk in production.

[jarnheimer]

Exception: It is unsafe to run Dusk in production is fired when deploying in production.

https://github.com/laravel/dusk/blob/master/src/DuskServiceProvider.php#L43

Read discussion here https://laracasts.com/discuss/channels/forge/it-is-unsafe-to-run-dusk-in-production-error-when-trying-to-deploy

[deleugpn]

That discussion has nothing to do with that change.

[jarnheimer]

@deleugpn Okay, I see. Thank you!

Please, tell me, has this code https://github.com/laravel/dusk/blob/master/src/DuskServiceProvider.php#L43 nothing to do with that error.

[deleugpn]

That code is what prevents Dusk from being registered when the environment is production. From that thread, the OP showed code that he intended to register Dusk only on local or testing. By getting that exception, it means he's probably registering Dusk somewhere else as well (and thus the exception saves his environment from being exposed). When he tried to remove everything, composer cache started giving him another unrelated problem.
The final point is: if you prevent Dusk from being registered in production, that exception will not happen. If you are getting that, you need to check your code.

[jarnheimer]

I see. My apologies. You can close this issue. Thanks a lot for the help @deleugpn

[browner12]

@jarnheimer as the OP you can close issues too. Should be a button at the bottom of the thread.

[deleugpn]

@jarnheimer you should not have DuskServiceProvider registered in your config/app.php providers. That's what makes Dusk be registered in production and, hence, the exception, to protect you.

[ajthinking]

I just wanted to share what was my issue when getting this exception. When installing to production server I just needed to use the --no-dev flag.

composer install --no-dev

[bitclaw]

FYI, you can also get this issue if you don't have a .env file

[deleugpn]

@bitclaw Just to clarify. An env file is just one way to setup environment variables for Laravel. By default, Laravel assumes production and after the environment variables are loaded, the value may be overwritten. If you don't have a .env file, but the operating system have actual environment variables, Laravel will pick that up. If you don't have either, production will be assumed.

[bitclaw]

You are right I should have clarified if you don't have the APP_ENV defined in either the .env file or as an environment variable since Laravel's env() and config() helper functions use inside the PHP getenv() function

[shane-smith]

I'm ashamed to admit that I'd forgotten the --no-dev flag on one of my newer projects.

Either way, just wanted to add that if you arrive here and add the --no-dev flag as per @ajthinking's comment, you may still face issues with your production server showing the error message.

If that happens, try connecting to the server manually and completely rebuilding the vendor directory:

cd <project-root>
rm -Rf vendor/
composer install --no-dev

[bretto36]

If you are getting this issue when running tests. Ensure you have a env.testing if you specify a different environment for tests

[zschuessler]

Just out of curiosity, what makes Dusk unsafe for production environments? Security or just potential data loss?

From what I understand of the source code, it's the potential data loss and not a security issue (at least, not _inherently_ a security issue). I have a use case where that's acceptable and I'd still like to run tests in a production environment.

Being able to control this behavior with a flag would be nice :)

[deleugpn]

Dusk exposes an endpoint that allows anybody to login as an user of your system by simply knowing the id of the record.

[zschuessler]

Ah I missed those routes being registered - thanks so much for the quick and informative response Marco 😄

I understand my use case is extremely rare so it's probably not worth implementing... but I extended these routes and added a gate/policy for them. Having this in the base package could help other rare cases that need this in production too.

Cheers mate, thanks again.

[ramseyjiang]

In laravel 5.8, after I install dusk and config APP_URL, then I run : php artisan dusk, it is fine.
But if I run phpunit, it will say "It is unsafe to run Dusk in production".
So I cannot run phpunit, who can help me to fix it?

The following is a part of composer.json.
"require": {
"php": "^7.1.3",
"fideloper/proxy": "^4.0",
"laravel/framework": "5.8.*",
"laravel/telescope": "^2.0",
"laravel/tinker": "^1.0"
},
"require-dev": {
"barryvdh/laravel-debugbar": "^3.2",
"barryvdh/laravel-ide-helper": "^2.6",
"beyondcode/laravel-dump-server": "^1.0",
"filp/whoops": "^2.0",
"fzaninotto/faker": "^1.4",
"laravel/dusk": "^5.2",
"mockery/mockery": "^1.0",
"nunomaduro/collision": "^2.0",
"phpunit/phpunit": "^7.5"
},

[staudenmeir]

@ramseyjiang How are you running PHPUnit? Are you using Laravel's phpunit.xml file? Do you have a .env.testing file?

[ramseyjiang]

@staudenmeir Before I asked the question, I ran phpunit directly. After I asked question, I found I was wrong, then I run: ./vender/bin/phpunit.
Because run phpunit directly, it will run all tests including dusk. That's why I changed to the second way.

I didn't have a .env.testing file, do I need it if I run ./vender/bin/phpunit? Yes, phpunit.xml, it generated automatically.

[staudenmeir]

So it's working now?

No, you don't need a .env.testing file.

[ramseyjiang]

@staudenmeir No, it is still not working. Errors are following:

Tests\Feature\ExampleTest::testBasicTest
ReflectionException: Class env does not exist

Currently, it is a fresh environment. I didn't start any development yet. Dusk works fine, but phpunit worked before I installed dusk into. Now phpunit still has that issue.

[ramseyjiang]

@staudenmeir

Thanks bro. I fixed it. I added the following row into php label in phpunit.xml, using env tag. Then ./vendor/bin/phpunit works fine.
name="TELESCOPE_ENABLED" value="false"

[MightyPork]

I just hit this when trying to test production behavior locally.

Would it not be possible to simply have a safeguard like this in the Service Provider?

    public function boot()
    {
        if ($this->app->environment('production')) {
            return;
        }
       ...
   // same for register()

I edited /vendor to add this change, and all is working perfectly now

[Patabugen]

To add one gotcha which caught me out while trying to implement @MightyPork 's in dev (with env='production' set to test) - dusk automatically registers if it's installed and that's when it throws the exception.

So remember to run composer install --no-dev on your local machine when testing that your DuskServiceProvider will work in production.

[Patabugen]

I've added another check to my AppServiceProvider to return if Dusk isn't installed after spending a huge amount of time debugging not very useful errors. This way if Dusk isn't available it'll not run your ServiceProvider (which in my case just registers a Macro). Then Dusk will give you a more useful error when it can't access the macro.

My deployment script was throwing an error when running composer install with this:

> @php artisan package:discover
Script @php artisan package:discover handling the post-autoload-dump event returned with error code 1     

In DuskServiceProvider.php line 20:

  Class 'Laravel\Dusk\Browser' not found

So I've also added a class_exists check in my DuskServiceProvider.

    public function boot()
    {
        if ($this->app->environment('production')) {
            return;
        }
        if (!\class_exists('\Laravel\Dusk\Browser', false)) {
            return;
        }

[carltondickson]

Check the contents of your .env file again even if you think it's fine.

https://laravel.com/docs/5.5/dusk#environment-handling

When running tests, Dusk will back-up your .env file and rename your Dusk environment to .env. Once the tests have completed, your .env file will be restored.

I was getting this because I had a bad .env.dusk.local file (that was temporarily commented out) and this was being copied at the start of the dusk tests. But because I had to force close the php artisan dusk process (something isn't working)....my original .env file was never restored...I think the original gets renamed to .env.backup if you need it again