Cms: Discourage use of @web in base URL

[putyourlightson]

From the docs (https://docs.craftcms.com/v3/sites.html#site-url):

Don’t ever use the @web alias when defining your sites’ Base URLs. It could introduce a cache poisoning vulnerability, and Craft won’t be able to reliably determine which site is being requested.

I completely agree with the warning about using @web in a site's base URL and therefore suggest changing the "Base URL" description text when editing a site in the control panel to something more appropriate.

[brandonkelly]

Yeah agree. We’re going to to move away from it (and aliases in general) in 3.1 in favor of environment variables thanks to the new support for them in CP settings (https://github.com/craftcms/cms/blob/3.1/docs/config/environments.md#control-panel-settings).

[putyourlightson]

Perfect, thanks!

[brandonkelly]

As of the next Craft 3.1 beta release, the web and CLI installers will no longer suggest @web for the site URL, and whatever URL is entered will be saved as a DEFAULT_SITE_URL environment variable in .env, and the actual site URL that gets stored will be replaced with $DEFAULT_SITE_URL (see 96867edd04d9e85f7727ee45a67fb95bcb5dde9f).

[jorenvanhee]

The CLI installer still uses @web as default site URL. Site URL: [@web/]

[brandonkelly]

That will only happen if you are installing with a config/project.yaml file already in place that defines a primary site with the baseUrl set to @web, or if you have a DEFAULT_SITE_URL environment variable defined, which is set to @web. In either case, Craft will just go with the flow. Otherwise no it will not recommend @web out of the blue anymore.