Is it safe/ok to have composer in production on a server hosting Magento?
Security wise there is no problem as long as composer.json, composer.lock and the vendor directory are outside of the document root. This is the case if you use the recommended setup with
pub as document root. Otherwise you should set up your web server such that there is no access to these files (e.g.
Deny from all in Apache configuration)
Why it is problematic if composer files are visible from the outside
- Information disclosure: Attackers can see exact version of all modules and libraries and easily look for known vulnerabilities
- Potential security risks in library files: For example there was one recent exploit in PHPUnit. PHPUnit files were never supposed to be accessible from the web, but if you do not protect
vendor, they are. Details: https://www.cvedetails.com/cve/CVE-2017-9841/
To prevent directory listings (for security purposes, for example), you should remove the Indexes keyword from every Options directive in your configuration file. Or to prevent them only for a single directory, you can use:
<Directory "/"> Options -Indexes </Directory>