Laravel: Use case for File Visibility?

Question

I am using Laravel with a local filesystem as storage driver.

I have understood that I can save files in the storage/public folder to make them accessible through myapp.dev/storage/image.jpg. I have also understood that I can make images accessible only for authenticated users like explained here.

What I have not understood it the File Visibility property. If files are public depending on the folder that I stored them, why would I need to declare them additionally as private or public? Could anyone give a use case where this would be necessary?

Discretion

Answer 1

File visibility option matters only if you are using cloud storage provider, e.g. Amazon S3 or something like that. If you are working with local file system then that option is ignored.

Eichelberger

"Ignored" is perhaps the wrong way to describe it. Files saved with public/private visiblity are given different read/write/execute permissions based on what is configured for the project. However, in many (the majority?) of server configurations both public and private settings may result in files being readable by the webserver and served to users, making it seem like the setting is ignored. One case where one might see a difference is if the webserver runs as the www-data user and php-fpm is run as its own user. Private files are 0600 permissions by default, so www-data can't read them. – Amharic

Answer 2

I would like to tell a different use case, even if you're only planning to use VPS, the difference is important.

Most good VPS implementation are serving HTTP traffic behind a reverse proxy, like Apache or NGINX. They run with their own linux user such as apache or nginx.

When server processing PHP files, they run under different user, such as www. Now, to make nginx be able to access your static files under /var/www you must add user apache/nginx to www group. This is should be done automatically if you using panels such as cPanel, Plesk, Virtualmin, etc.

Now here's the important part: A private file is set with 0600 file mode and a public file is set for 0644 file mode, according to Laravel documentation.

If you came into problem where your uploaded files are inaccessible, then this is the problem, you must set the file access to public. This is simply because Apache/NGINX wants to access that file directly but they can't.

Note that a file set to private is still actually useful to secure the files, but you have to write another route to let users can access them with some kind of authentication.

Frogmouth