RE: [coldbox:11988] Re: Modules and web accessible resources

Andrew, I have no direct argument against what you are saying, but my reasons for keeping stuff outside the webroot are usually less aligned with security and more for the purpose of sharing those components across multiple applications. I think it’s reasonable to expect that if you write a module, a number of people who try to use it will attempt to stick it in an external location (outside of the webroot) and I personally would like to see if there’s a convention by which we can define the standard method of handling static assets in a module that won’t require separate setup for every CB module you use.

Maybe this would be a good time to get a show of hands on how many people just keep everything in their web root to begin with. Perhaps I really am an exception and the majority of people don’t keep their cfcs outside of the web root.


If you are using ColdBox give me one good reason why placing it outside of the webroot is your preference?

In other words, what are you trying to stop from happening?

Here are the entire contents of my webroot in ANY and ALL applications:


Period. Does not matter what framework. There are so many good reasons to keep your model, etc, outside of the webroot that I am not even going to bother attempting to discuss them. On the contrary, there are absolutely ZERO good reasons to keep everything inside the webroot, so there is nothing to discuss.

Name two Matt.