I am setting up a private files folder outside of www. I have set the permissions to allow access to the folder by www-data to read and write but not execute, however, my drupal 8 site is now showing an error:
PRIVATE FILES DIRECTORY Not fully protected See https://www.drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the /var/drupal_data directory to help protect against arbitrary code execution.
That link is to an advisory and fixes regarding Drupal 6 and 7. There is no mention of of Drupal 8 and it appears reasonably out of date:
20 Nov 2013
I didn't think apache could even utilise htaccess outside of the www folder in such a way.
Is there some other configuration or permission I need to be changing?
Up until now, for testing, I have had a private folder within the public files directory. I wish to move the private files directory outside the root directory as I am lead to believe it is better for security.
While many guides discuss the best practice of moving this folder outside the root directory few go in to much detail about either why that is beneficial or how that changes the site setup. If there are good recent explanations for this practice I would appreciate being directed to them.