With Drupal 8/9 I want to:

  1. Have a private file folder
  2. Upload files to it (ideally by whatever method but media type will do)
  3. Allow only authenticated users (ideally set by role) to view the file (whether by direct link or link in WYSIWYG editor)

Why does this seem to be so hard? Am I missing something?

When I set up private files using the online documentation I can find it either blocks everyone but the Admin from seeing the direct link or allows anonymous users to view the link even if the private files folder is outside the webroot. There seems to be no fine-grained control of permissions.

1 Answer 1


Drupal terminology can be confusing.

In Drupal core, "public" files mean "open to the public at a publicly accessible URL". With public files, visitors can download the original file and you have no control over that, as the file is made publicly accessible via the webserver.

With "private" files, Drupal itself handles the serving of the files, which means that the files are not available via a webserver URL; instead, Drupal serves the files. This doesn't have anything to do with permissions or keeping files private from some users; it means keeping files private vs. the web itself.

How to add permissions to files

You can use the Private Files Download Permission module. There's a basic tutorial to get you started.

  • That tutorial implies the module manages permissions for files linked to a field. Will it actually control direct links to a specific file NOT connected to a node/entity/page? I need to control access to files on the server, not just those in fields on a content type.
    – tanbog
    Mar 31, 2022 at 1:13
  • @tanbog The module manages files registered with entities based on Drupal permissions. I am not aware of a solution for using Drupal permissions to manage files on the webserver (which are usually controlled by the webserver permissions, not Drupal's), but perhaps such a thing exists. Mar 31, 2022 at 2:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.