"recommended-project" installs drupal into the /web subdirectory, but hosting solution directs traffic to webroot

Question

Per https://www.drupal.org/node/3082474 the preferred document template, drupal/recommended-project, uses a "relocated document root" for security purposes. HOWEVER, many cPanel driven hosting services mandate that the website user lands in the hosting site's public_html web root directory. I can't make it work for a website vistor.

I have researched many ways to accommodate through the use of .htaccess files and settings.php; however, nothing I've tried actually works. For example, I can land on the page, but if I try to log-in, then it gets lost. Or /web shows up in the address bar. Or people write about security concerns that are worse than not doing the relocated document root in the first place. Or...

This solution is "STANDARD", so there must be a well-researched standard way for a web user to land on the public_html, but be redirected SECURELY to the /web subdirectory.

UPDATE: this is the best solution that I have found and it seems to work safely, per https://www.drupal.org/project/drupal/issues/2612160#comment-11767977. I inserted this snippet at the bottom of /web/sites/default/settings.php file:

if (isset($GLOBALS['request']) and
'/web/index.php' === $GLOBALS['request']->server->get('SCRIPT_NAME')) {
$GLOBALS['request']->server->set('SCRIPT_NAME', '/index.php');
}

(with /web/ being the name of the subdirectory below the web root).

I also had to add this to my .htaccess file at the webroot, public_html:

# https://www.inmotionhosting.com/support/domain-names/how-to-redirect-your-primary-domain-to-a-subdirectory/

RewriteEngine on
RewriteCond %{HTTP_HOST} ^(www.)?domain_name.com$
RewriteCond %{REQUEST_URI} !^/web/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /web/$1
RewriteCond %{HTTP_HOST} ^(www.)?domain_name.com$
RewriteRule ^(/)?$ web/index.html [L]

(with /web/ being the name of the subdirectory below the web root). Substitute your domain_name in the two places above).

Answer 1

When you use the drupal/recommended-project template to create a Drupal project via Composer, you can use a different directory for the server document root.

Instead of running composer create-project drupal/recommended-project my-project, assuming that the document root directory is public_html, you can:

• Run composer create-project drupal/recommended-project my-project --no-installation
• Edit the composer.json file found in the my-project directory to replace any occurrence of web/ with public_html/
• Inside the my-project directory run composer install
• Copy the content of the my-project directory (including any subdirectory) into the directory containing the server document root directory

This is described in Using Composer to Install Drupal and Manage Dependencies.

If you want to modify some of the properties of the downloaded composer.json before composer install is executed, use the --no-install flag when running composer create-project. For example, it is possible that you want to rename the subdirectory 'web' to something else.

To do that:

1. Run composer create-project --no-install drupal/recommended-project my_site_name_dir
2. Change directories to my_site_name_dir and edit the composer.json file to suit your needs. For example, to change the sub-directory from 'web' to something else, the keys to modify are the 'extra' sub-keys 'webroot' and 'installer-paths'.
3. Run composer install to download Drupal 8 and all its dependencies.