Private folder issues with NGINX

Question

So I have been setting up my Drupal 8 installation and I'm having troubles with my private folder setup.

I went on to settings.php and specified the path which I wanted for my private folder as sites/default/files/private. It seemed to be working well for a while, but now it isn't.

I have configured Drupal to use the private folder as default location for file uploads and it shows the sites/default/files/privatepath as the private folder path.

Now my issue is that I created a custom content-type with a private folder file upload field. This is for a restricted area I have in the website which I only want authorized (logged in) users to be able to access - both that area, and the files linked there.

The area was successfully blocked via role permissions and works great. The files attached to content - even though the content-type settings are explicitly and correctly set to use the private folder for upload - result in the following behavior:

• files served by direct HTTP in sites/default/filesare accessible, regardless of Drupal login state - as intended
• files served by direct HTTP in sites/default/files/private are blocked with a 403 forbidden by NGINX regardless of Drupal login state - as intended
• restricted files served by Drupal in the restricted area with an URI similar to system/files/YEAR-MONTH don't show Drupal's access denied 403 page (the intended effect), BUT INSTEAD:
  • if they are images, I get an NGINX 404 NOT FOUND error page
  • if they are other file-types, they are accessible without restriction (exactly what I'm trying to prevent).

Right now I'm lost as I've been searching around for answers on these issues, but I can't seem to find them.

I'm using a shared web server setup in which I don't have direct access to NGINX's .conf files. I'm also using the IMCE File Manager module. I think that the images issue is related to some NGINX conf and as such I'll have to contact the web server maintainer to fix it, but I'd like to have some insight to share with them about this. Also, what can possibly explain the files being uploaded to the private folder being accessible without any restriction?

Any help would be very welcome, thanks!

Answer 1

It has been a while since I created this question, and as such I might be missing quite a few details, but I eventually did find a solution.

TL;DR It should probably relate to NGINX, so cover all the bases related to it. NGINX's official Drupal recipe helped me a lot, you might want to check that first. Although, if you're using Drupal 8, you'll need to update/change some settings for it. You might find some of them here.

Can't recall much about my specific case, but this checklist might be worth checking out in your setup:

• settings.php be careful and mindful of the options you have setup in your settings file. IIRC, I think the private folder path value was all I changed regarding this issue.
• Drupal configuration - in Drupal's admin backend, go to Configuration > Media > File System and make sure you have the correct option selected for your use case, either public/private. This will setup your default file upload location, but can be overridden in the content type's definition, if I'm not mistaken.
• Content type definition - make sure that your content type using the file field is setup properly and also according to your needs. I think at some point I even re-created my content-types just to make sure there wasn't stale info in the DB.
• Drupal role permissions - this was probably one of my biggest headaches with this issue. Make sure they are properly setup and test them thoroughly. In this process I discovered the Masquerade module, which has helped me a lot ever since.
• Folder permissions - The folders you want to use for both private and public uploads should be writable by Drupal/NGINX, but NGINX should not enable HTTP access to them.
• NGINX - this is definitely the most important part. What you basically need to absolutely make sure of is that Drupal handles it's own URLs, and everything else is handled by NGINX accordingly. This can get confusing really fast, so here are some more tips:
  • Drupal will have it's own file URL being generated internally and saved to the DB. This should make Drupal respond and take over HTTP requests to a system/files/YEAR-MONTH-type URL.
  • NGINX on the other hand, must let Drupal handle those requests, while intercepting and preventing direct access to sites/default/files/private, or whatever folder you have setup for private files.
  • This should be fixed by setting up the correct NGINX directive regarding the path you want/need it to handle. This might help. Also, go read about Perusio's NGINX setup, as there are a lot of valuable nuggets of information there (D8's setup is equivalent to D7).
  • I think some specific NGINX directives may target certain file-types differently (maybe something related to MIME types, not sure). This could explain if your issue happens with, ie, JPG, but not PDF or vice-versa. Couldn't find info on this, though.

@GokulNK I'm sorry if this isn't enough help, but I really can't recall what I did to fix it. Hopefully it'll point you in the right direction, though.

EDIT: I found an old email with the webserver's maintainer discussing some NGINX directives that has some info that might be relevant:

# handled by NGINX
location ~ ^/sites/default/files/private/ {
    return 403;
}  

# Handle private files through Drupal.
location ~ ^/system/files/ { # For Drupal >= 7
    try_files $uri /index.php?$query_string;
}