core-bundle/src/EventListener/InsecureInstallationListener.php
public function onKernelRequest(GetResponseEvent $event): void
    {
        $request = $event->getRequest();

        // Skip the check on localhost
        if (\in_array($request->getClientIp(), ['127.0.0.1', 'fe80::1', '::1'], true)) {
            return;
        }

        // The document root is not in a subdirectory
        if ('' === $request->getBasePath()) {
            return;
        }

        throw new InsecureInstallationException(
            'Your installation is not secure. Please set the document root to the /web subfolder.'
        );
    }
public function onKernelRequest(GetResponseEvent $event): void
    {
        $request = $event->getRequest();

        // Skip the check on localhost
        if (\in_array($request->getClientIp(), ['127.0.0.1', 'fe80::1', '::1'], true)) {
            return;
        }

        // The document root is not in a subdirectory
        if ('' === $request->getBasePath()) {
            return;
        }

        throw new InsecureInstallationException(
            'Your installation is not secure. Please set the document root to the /web subfolder.'
        );
    }
Throws an exception if the document root is insecure.

@throws InsecureInstallationException