How can i make my media files stored as private and protected? The users shoud only have access to that file if they click from the node file link, on nodes they can access to.

On a fresh install,the only destination option is public


enter image description here


i have now /admin/config/media/file-system

Chemin du système privé de fichier C:\xampp\private

i have created a new file media with private storage destination

i have created on the basic page an entity ref field to that media and create a content

the direct file access is not blocked so i consider it is not working http://localhost/drupal-8.6.7/system/files/2019-05/recherche-dev.pdf

the documentatiion mention on an apache server /docs/8/core/modules/file/overview

When you specify the private directory in admin/config/media/file-system it will automatically create the sub-directory & create a simple .htaccess file with Deny from all. This stops Apache from serving files from this director

it does not work

  • 1
    Have a look in settings.php there's an option where you define the private files path. Unless that's set and writable the option won't be shown – Leigh May 17 '19 at 13:17
  • how writable ? the settings was done as such $settings['file_private_path'] = "sites/default/files/private"; – Matoeil May 17 '19 at 13:21
  • 1
    It needs to be the full file path to the folder and not relative to the website. e.g. /var/www/private. It's also got to be outside of the websites folder structure, there's no point trying to create private files if you stick it in /sites/default/files which is accessible to the outside world. Have a read of the comments within settings.php it explains all of this ready – Leigh May 17 '19 at 13:24
  • 2
    It's ok to put it in e.g. sites/default/files/private, as long as your web server is protecting that folder. The default .htaccess that Drupal places there has a deny from all which is usually sufficient for apache, other web servers will need something specific configured. Outside the docroot is definitely preferable, though, it will help to avoid possible errors from upstream config (e.g. the folder somehow becomes AllowOverride none from the web server config, rendering the deny in .htaccess useless), and make the site more easily portable to other server software in the future – Clive May 17 '19 at 13:38
  • what would be the nginx conf in that case ? – Matoeil May 17 '19 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.