Welcome to the Treehouse Community

Want to collaborate on code errors? Have bugs you need feedback on? Looking for an extra set of eyes on your latest project? Get support with fellow developers, designers, and programmers of all backgrounds and skill levels here with the Treehouse Community! While you're at it, check out some resources Treehouse students have shared here.

Looking to learn something new?

Treehouse offers a seven day free trial for new students. Get access to thousands of hours of content and join thousands of Treehouse students and alumni in the community today.

Start your free trial

PHP

Posted by Stefan Hoffmann
Stefan Hoffmann
24,811 Points

Building Websites with PHP / Composer Security

In the course "building websites with php" we get taught about the usage of composer.

Now the files in the vendor folder do not look very protected to me. Actually i believe that one could very easily remotely check subfolders of any website build this way and find out which libraries are used in which versions. Leaving composer.json in the root directory, isn't this a risk too?

Is it even possible to secure such a site? Since index.php and composer.json are on the same level?

What should best practices be. Shouldn't there be at least a .htaccess file in place that disallows the vendor directory to be traversed?

Thanks in advance! Best regards, Stefan

1 Answer