Decoupled Drupal - Security: files structure I am running a Drupal 8.9.2 site as a content repository accessed via an Angular 8 app. So there is one administrator who uses the Drupal interface to write content / upload files eccc.... and anonymous users view that content via the Angular app.
I have set up some views with REST Export display and have been able to pull the content in my Angular app running both backend and frontend on localhost, but when I deployed to the server problems have arisen...
all my calls fail or get canceled, this was the configuration on localhost: the Drupal website was in a folder in XAMPP/htdocs/example the views rest endpoints were like: http://localhost/example/web/api/content the Angular app was in a folder on the desktop and was served at http://localhost:4200/home
now I put all the files for both backend and frontend on the root folder on the server, I also have commented this line ErrorDocument 404 /index.php in the htaccess file found in the web folder so that non existent urls are managed by the Angular app.
So the question is: What is the correct files structure in order to have the frontend at example.com/home and my Drupal site at example.com/web/admin/eccc..... (if it is possible, otherwise please suggest a better option).
I solved my problem, the calls were failing due to a wrong version of PHP (you need 7.2 or higher).
As for the files structure I just put all the files in the root folder, both for Drupal and Angular, it works having my Drupal site in the web folder, I don't know for other configurations.