I am running an EC2 instance in amazon and a RDS instance, and everything works just fine. I upgraded RDS's instance type and also changed the master password as I regularly do once in a while..
But after the modification itself, I tried to login into my app (like, 30 seconds after I clicked on 'modify now'), before I changed the db credentials in my laravel .env file, and suddenly I saw an error page which fully exposed my db credentials for these 2-3 minutes before I updated them to the correct ones within the .env file. Needless to mention that there were at least a few dozens of people who probably tried to reach my app during this time as well.
So I was wondering whether it was a bad security practice done by myself or whether it's some laravel's flaw which wasn't yet handled?
The error message looked like this - (I replace the real credentials with realUserName / realPassword and realDbName, and the host name is censored as well)
Whoops, looks like something went wrong.
1/1
PDOException in Connector.php line 55:
SQLSTATE[28000] [1045] Access denied for user 'realUserName'@'172.**.**.***' (using password: YES)
1. in Connector.php line 55
2. at PDO->__construct('mysql:host=testApp.*****.us-east-1.rds.amazonaws.com;dbname=realDbName', 'realUserName', 'realPassword', array('0', '2', '0', false, '0')) in Connector.php line 55
3. at Connector->createConnection('mysql:host=testApp.*****.us-east-1.rds.amazonaws.com;dbname=realDbName', array('driver' => 'mysql', 'host' => 'testApp.******.us-east-1.rds.amazonaws.com', 'database' => 'realDbName', 'username' => 'realUserName', 'password' => 'realPassword', 'charset' => 'utf8', 'collation' => 'utf8_unicode_ci', 'prefix' => '', 'strict' => false, 'name' => 'mysql'), array('0', '2', '0', false, '0')) in MySqlConnector.php line 24
4. at MySqlConnector->connect(array('driver' => 'mysql', 'host' => 'testApp.****.us-east-1.rds.amazonaws.com', 'database' => 'realDbName', 'username' => 'realUserName', 'password' => 'realPassword', 'charset' => 'utf8', 'collation' => 'utf8_unicode_ci', 'prefix' => '', 'strict' => false, 'name' => 'mysql')) in ConnectionFactory.php line 61
5. at ConnectionFactory->Illuminate\Database\Connectors\{closure}()
6. at call_user_func(object(Closure)) in Connection.php line 924