The normal behavior, described also in Give access to private files to certain role? seem to be the following.

Once configured, files stored in the private directory are inaccessible via a direct link; however, if Drupal constructs a link to the file, the file will be accessible to anyone who can see the link.

Does it work for media type fields? How can it be configured?

I would like the files to be accessible only from users who authenticate themselves using CAS.


You can use the private file system with media entities. Users who have permission to view the entity they are attached to will be able to access the files. So if your file is attached to a media entity that is attached to a publicly visible node, the node is public, so the file will be open to anyone. If you add some sort of viewing permissions to the node through a contributed module or something, then the files will only be visible to those users. It is however possible to do custom permissions, using hook_file_download().

|improve this answer|||||
  • how can i configure the private file system with media entities? – Matoeil May 17 '19 at 13:08
  • 1
    Sorry, it looks like I spoke wrong. I've just done some testing, and it doesn't look like private files with media is possible by default. This module attempts to solve the issue: drupal.org/project/media_private_access but it's not yet ready. – Jaypan May 17 '19 at 22:54

We have ended up using the protected file module.

File medias chosen to be protected are only accessible to authentified users.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.