Use alias for site url based on root url defined as env var?
Good practice imo, it's what I do as well. Values come from the .env vars, and for things that are URLs or paths, I make aliases out of them to take advantage of what you're showing above.

This cannot cause any kind of issue like @web -- the only thing wrong with @web is that the host name is computed dynamically, potentially from untrusted browser data.

You're not doing that here, you are explicitly providing the host name, so it's totally fine. You could even do:

'aliases' =&gt; [
        '@web' =&gt; getenv('ROOT_URL'),
    ],



...to redefine the dynamically generated @web alias to something that is from a static value for the URL.