Framework: undocumented default _ignition routes on creation (vulnerability?)

[Osmiogrzesznik]

• Laravel Version: 6.0.3
• PHP Version: 7.3
• Database Driver & Version: N/a

Description: _ignition routes created on start. (bug?). Could not find any documentation or indication that this is an expected behaviour.

Steps To Reproduce: just simply create new project

bash $ laravel new project
php artisan route:list

could not google any info about it .

[devcircus]

Laravel's default exception tracker(Facade\Ignition) registers the routes needed for the exceptions, during installation.

[Osmiogrzesznik]

Thank you. Still, it feels like there's nothing about it in documentation. How to disable it before deployment.? from what i can gather it allows for running scripts through GET ?

[devcircus]

Ignition is open source on github (https://github.com/facade/ignition), so you can see exactly what's going on if you'd like. It's the app that powers Laravel's error pages for development. I don't think I'd disable unless you want to go back to using the package that was used previously.

[SlyDave]

You shouldn't be deploying Ignition into a production environment. ensure it's only a devDependency.

[driesvints]

See the answers by @devcircus and @SlyDave

[Osmiogrzesznik]

Thanks