Private file folder outside document root

Question

I am setting up a private files folder outside of www. I have set the permissions to allow access to the folder by www-data to read and write but not execute, however, my drupal 8 site is now showing an error:

PRIVATE FILES DIRECTORY Not fully protected See https://www.drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the /var/drupal_data directory to help protect against arbitrary code execution.

That link is to an advisory and fixes regarding Drupal 6 and 7. There is no mention of of Drupal 8 and it appears reasonably out of date:

20 Nov 2013

I didn't think apache could even utilise htaccess outside of the www folder in such a way.

Is there some other configuration or permission I need to be changing?

Up until now, for testing, I have had a private folder within the public files directory. I wish to move the private files directory outside the root directory as I am lead to believe it is better for security.

While many guides discuss the best practice of moving this folder outside the root directory few go in to much detail about either why that is beneficial or how that changes the site setup. If there are good recent explanations for this practice I would appreciate being directed to them.

Answer 1

Looking at the code in system.install that raises this error it just checks if private://.htaccess exists:

$htaccess_files['private://.htaccess'] = [
    'title' => t('Private files directory'),
    'directory' => drupal_realpath('private://'),
];

...

foreach ($htaccess_files as $htaccess_file => $info) {
  // Check for the string which was added to the recommended .htaccess file
  // in the latest security update.
  if (!file_exists($htaccess_file) || !($contents = @file_get_contents($htaccess_file)) || strpos($contents, 'Drupal_Security_Do_Not_Remove_See_SA_2013_003') === FALSE) {
    $url = 'https://www.drupal.org/SA-CORE-2013-003';
    $requirements[$htaccess_file] = [
      'title' => $info['title'],
      'value' => t('Not fully protected'),
      'severity' => REQUIREMENT_ERROR,
      'description' => t('See <a href=":url">@url</a> for information about the recommended .htaccess file which should be added to the %directory directory to help protect against arbitrary code execution.', [':url' => $url, '@url' => $url, '%directory' => $info['directory']]),
    ];
  }
}

At no point does it check if your private file directly is actually inside webroot or not.

This means in your case it's a false warning and you can ignore it, as your right in saying there is no point putting an .htacess file to deny access in a folder outside of webroot.