When serving a site with Apache, there are two ways that I know of placing some content at "servername/foo":
- Place it in the web root under a folder called 'foo'
- Create an alias
As an example of #2, XAMPP has these statements in a config file:
Alias /phpmyadmin "C:/xampp/phpMyAdmin/" <Directory "C:/xampp/phpMyAdmin"> AllowOverride AuthConfig Order allow,deny Allow from all </Directory>
...Which means "if the server is localhost, and somebody visits localhost/phpmyadmin, show them the contents of C:/xampp/phpMyAdmin, given the following permissions."
In this example, given that phpMyAdmin is accessible from the same URL, does it matter from a security perspective whether it's in the web root folder or just aliased to look as though it were?