1

Pieces of web applications such as WordPress or moodle require to specify the URL that the user will provide in order to visit the site. For example, in moodle has the $CFG->wwwroot config parameter that takes the value of the website's/webapp's URL.

So I was wondering what benefit this approach offers into the web app's security. Also, I am developing a web application, so I was thinking what I achieve by adopting this mechanism into my web app instead of just not do any check at all.

Improve this question
2
  • If you don't configure the webapp's URL, what is the webapp's URL?
    – Hagen von Eitzen
    Oct 31, 2019 at 10:33
  • 1
    I am asking why do I need to configure it, I mean a typical Virtual Host in any webserver, can serve my web application without the need for the web application itself to know its url.
    – Dimitrios Desyllas
    Oct 31, 2019 at 10:35

1 Answer 1

Reset to default
1

speaking specifically for moodle, it's used to allow changing the path dynamically based on config. This lets you host a site at, ex domain.com/moodleroot instead of just domain.com, allowing one server to host many copies of moodle. If you don't need that capability, it's not worth the hassle of re-interpreting relative URLs. It also allows isolating parts to use a different root/server, for testing purposes w/o bringing down a live system; the path can be altered/interpreted for just the one user running tests.

I don't see any big security implication one way or the other though, it's more of a deployment matter.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .