Why in Drupal 8 is possible to override the base_url for public files using the file_public_base_url but not for private files? There are scenenarios where Drupal is installed behind a reverse proxy. The private files point to the hostname where the backend server is, instead of pointing to the frontend server.

Perhaps a workaround is to use the mod_substitute module (http://httpd.apache.org/docs/2.4/mod/mod_substitute.html) but I don't know if it's the best on.

  • Because you're serving the files via code/PHP and not directly from Apache because they're private files and gated access is required?
    – mradcliffe
    Commented May 18, 2019 at 19:00

1 Answer 1


The private files point to the hostname where the backend server is, instead of pointing to the frontend server.

Private files are not directly served to the user. Public files are served directly to the user. With a public file, when a file is requested, PHP is never executed, and therefore Drupal is never executed. By virtue of the files being public, they do not require any access checks, and so there is no reason to bootstrap Drupal. Instead, the server (apache, windows etc) serves the files directly to the user. The proxy can then cache that response, since the response for that file will always be the same for everyone.

Private files on the other hand require access checks. By definition, they are meant to have access checks performed upon them before they are served to the user. With private files, the request for a file is made to a php script (index.php - from which every Drupal request begins). This script (which is Drupal) runs access checks on the requested files. If the the access checks are passed, Drupal reads the data from the actual file, then sends a binary file response to the browser (rather than an HTML response, which would be a webpage). This binary file response is the file, which the browser either then renders or offers to the user as a download, depending on the file type and their browser settings.

An analogy to these files systems is to consider public files to be like wanting a cola, and going to the fridge to get it, while private files are like wanting a beer, asking a server for it, who then checks your ID and if you are old enough, gets it from the fridge, and brings it to you.

So private files by their definition cannot be directly accessed, as a script (Drupal) first needs to check whether the user should have access. As such, private files cannot be cached by the proxy, as the proxy has no means of checking access. This is why the base URL cannot be overridden.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.