HTTP Client environment file visibility and version control protection

Answer

PhpStorm does not provide a built‑in setting that forces developers to use environment variables instead of hardcoded values in .http files, nor does it automatically warn when a file marked as “Private” is staged for commit. The IDE’s private‑file feature only adds an entry to .idea/gitignore; it cannot stop a user from overriding that ignore rule or from committing secrets directly in request files.

Confirmed facts

• When you create an environment file and tick the “Private” checkbox, PhpStorm adds the file path to .idea/gitignore (e.g., http-client.env.json).
• Files listed in .idea/gitignore are ignored by Git only as long as the ignore rule is not overridden by a later !pattern or by a forced git add -f.
• PhpStorm’s inspection engine can be extended with a Structural Search and Replace (SSR) pattern to flag likely hardcoded credentials (e.g., strings matching password\s*=\s*['\"][^'\"]+['\"]) inside .http files.
• Git‑level protection (pre‑commit hooks, git‑secrets, or repository‑level .gitignore rules) is the reliable way to block commits of private environment files or of files containing secret‑like patterns.

Steps to mitigate the risk

1. Ensure the private environment file is truly ignored:
   1. Open .idea/gitignore and verify a line like http-client.env.json exists.
   2. Run git check-ignore -v http-client.env.json – the output should show the rule from .idea/gitignore.
2. Add a repository‑wide .gitignore entry for the environment file (or for *.env*) as a safety net in case the .idea directory is excluded.
3. Set up a pre‑commit hook that aborts if the private file is staged:

   #!/usr/bin/env bash
   if git diff --cached --name-only | grep -q '^http-client.env.json$'; then
     echo "Error: Private environment file is staged for commit."
     exit 1
   fi
   

   Make the script executable and place it in .git/hooks/pre-commit (or use a framework like husky).
4. Create a custom inspection to catch hardcoded secrets in .http files:
   1. Open Settings/Preferences | Editor | Inspections.
   2. Click the + button → Structural Search Replace → Add Template.
   3. Define a pattern such as $Password$\s*=\s*['\"][^'\"]+['\"] with a severity of Warning.
   4. Apply the inspection to the scope *.http files.
5. Educate the team to use the HTTP Client’s {{variable}} syntax and to never place raw credentials directly in .http files.

What to verify

• Run git status – the private environment file should not appear under “Untracked files”.
• Attempt git add -f http-client.env.json; the file will be added only if you force it, confirming that the ignore rule is active but overridable.
• Trigger the custom inspection by inserting a hardcoded password in a .http file; a warning should appear in the editor.

If you are using a PhpStorm version prior to 2023.2, the UI for marking a file as “Private” may differ slightly; the underlying .idea/gitignore mechanism remains the same.