how to use composer when application and system directory are not in webroot?

Assuming you want vendor/ at the same level as application/ then, using the example code below, adjusting for some other file structure is automatic as long as vendor/ and application/ retain the same relationship in the file hierarchy

PHP Code:

$config['composer_autoload'] = str_replace('application/', 'vendor/', APPATH); 


If you're going with vendor/ inside application/ then do this.

PHP Code:

$config['composer_autoload'] = APPATH . 'vendor/'; 


There is no advantage or disadvantage I can think of for having them one place or the other, but I agree it is best to have both outside the public space.