Store Uploads Privately and Prevent Execution: A Practical PHP and Laravel Security Guide

Uploading a file should never automatically make it public or allow it to become executable application code. This guide explains what private uploads mean, why they matter, when to use them, where to configure them, how to implement them, and what should happen afterward.

The examples expand on section 6 of the Laravel PHP Security Checklist on Debug School. They are illustrative implementation patterns; adapt paths, authentication, policies, and storage limits to your application.

1. What does “store uploads privately and prevent execution” mean?

It means enforcing two separate protections:

1. Privacy: Only authorized people can retrieve a sensitive file.
2. Execution prevention: Uploaded content is treated as data and never interpreted as server application code.

For example, a patient's medical report must not be accessible merely because someone knows its URL. A file uploaded as a document must never become a PHP program executed by the website.

A folder called private is not automatically secure. An Apache alias, public symlink, object-storage policy, or application endpoint can still expose it.

2. Why is this important for security?

Private storage is not encryption, malware detection, or a complete defense against server compromise. It is an access boundary. Other controls address other risks.

3. When should uploads be private?

For MotoShare, keep public vehicle photos separate from customer identity documents. For MyHospitalNow, serve patient documents only after the relevant patient or care-team authorization check.

4. Where should the configuration and code go?

Configure the website's document root as the Laravel public directory, rather than the entire project. Do not expose private storage through an alias or symlink.

5. How do you configure private Laravel storage?

Add a named disk inside the existing disks array in config/filesystems.php:

'private_uploads' => [
    'driver' => 'local',
    'root' => storage_path('app/private/uploads'),
    'visibility' => 'private',
    'throw' => true,
],

Syntax, meaning, purpose, and security benefit

Laravel versions and existing projects can have different default disk configurations. An explicit named disk avoids relying on an assumed default. Never point a public storage link at this private directory.

6. How do you upload a document safely in Laravel?

This example assumes a Document model with user_id, path, and original_name columns. Include the methods in your controller and adapt model namespaces as needed.

use App\Models\Document;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Storage;

public function store(Request $request)
{
    $request->validate([
        'document' => [
            'required',
            'file',
            'mimes:pdf',
            'max:5120',
        ],
    ]);

    $file = $request->file('document');
    $path = $file->store('', 'private_uploads');

    try {
        $document = new Document();
        $document->user_id = $request->user()->id;
        $document->path = $path;
        $document->original_name = $file->getClientOriginalName();
        $document->save();
    } catch (\Throwable $exception) {
        Storage::disk('private_uploads')->delete($path);
        throw $exception;
    }

    return response()->json(['id' => $document->id], 201);
}

Protect this endpoint with authentication, applicable upload permissions, CSRF protection for session-based forms, rate limits, and per-user storage quotas. Do not accept an owner ID from the client as proof of ownership.

The cleanup above handles an ordinary database failure. A process crash can still leave an orphan file, so periodically reconcile abandoned uploads. Cleanup failures should be logged and retried.

Why generate the filename?

// Avoid using client-controlled names as storage destinations.
$name = $request->file('document')->getClientOriginalName();

// Prefer Laravel's generated storage filename.
$path = $request->file('document')->store('', 'private_uploads');

Generated names reduce collisions and exposure to dangerous filename handling. They do not replace authorization. Treat the original filename as untrusted text; escape it when displayed:

{{ $document->original_name }}

7. How should private downloads work?

The client requests a document ID. The server retrieves its stored record, checks permission, and returns its bytes.

use App\Models\Document;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Storage;

public function download(Request $request, Document $document)
{
    abort_unless(
        (string) $document->user_id === (string) $request->user()->id,
        403
    );

    $disk = Storage::disk('private_uploads');
    abort_unless($disk->exists($document->path), 404);

    return $disk->download(
        $document->path,
        'document.pdf',
        [
            'Content-Type' => 'application/pdf',
            'X-Content-Type-Options' => 'nosniff',
            'Cache-Control' => 'private, no-store',
        ]
    );
}

use App\Http\Controllers\DocumentController;
use Illuminate\Support\Facades\Route;

Route::middleware('auth')->group(function () {
    Route::post('/documents', [DocumentController::class, 'store'])
        ->middleware('throttle:10,1');

    Route::get('/documents/{document}/download',
        [DocumentController::class, 'download']);
});

Use the authentication middleware configured for your application; token APIs may use auth:sanctum or another guard. The download example allows only the owner. Use a policy for administrators, hospitals, or team sharing.

Never let the user choose a filesystem path

// Dangerous: user input selects a server file.
return response()->download($request->query('path'));

Use the authorized document record's stored path. Never expose a general-purpose file reader. A UUID or an obscure URL is not an access-control mechanism.

8. How do you prevent execution with Apache?

For private uploads, first keep the directory outside the web root. As additional protection, deny direct HTTP access to it in the relevant Apache 2.4 configuration:

# Example absolute path: replace with the actual directory.
<Directory "/services/myapp/storage/app/private">
    AllowOverride None
    Options -Indexes -ExecCGI
    Require all denied
</Directory>

Important distinctions:

• Options -Indexes does not block a known file URL.
• Options -ExecCGI alone does not disable mod_php or PHP-FPM.
• A file without its executable permission bit may still be interpreted by PHP.
• A noexec mount does not stop an interpreter from reading a script.
• Rules for a public upload directory depend on the effective handler configuration. Do not assume a short extension blocklist covers every handler or alternative suffix.
• Apache access rules do not stop application code from reading the directory. The download controller still needs authorization.

For public photos, prefer a dedicated static-serving location or service that has no script handler, and allow only the formats the feature needs. Public HTML and SVG can introduce browser-side script risks even when server-side PHP execution is disabled.

Never interpret uploads as code

// Never do this with untrusted uploaded content.
include $uploadedPath;
require $uploadedPath;

Do not pass user-selected uploads into a PHP interpreter, template compiler, or shell command. Document and image converters should run with restricted permissions and CPU, memory, and time budgets.

9. How do you implement private storage in plain PHP?

This example expects an authenticated and authorized upload endpoint with appropriate CSRF protection. Provision /srv/myapp-private/uploads outside the web root with the correct ownership before using it.

<?php

$file = $_FILES['document'] ?? null;

if (
    !$file ||
    !is_int($file['error'] ?? null) ||
    $file['error'] !== UPLOAD_ERR_OK ||
    !is_string($file['tmp_name'] ?? null)
) {
    http_response_code(400);
    exit('Invalid upload');
}

$tmp = $file['tmp_name'];

if (!is_uploaded_file($tmp)) {
    http_response_code(400);
    exit('Invalid upload source');
}

$size = filesize($tmp);

if ($size === false || $size === 0 || $size > 5 * 1024 * 1024) {
    http_response_code(422);
    exit('Invalid file size');
}

$mime = (new finfo(FILEINFO_MIME_TYPE))->file($tmp);

if ($mime !== 'application/pdf') {
    http_response_code(422);
    exit('Only PDF documents are accepted');
}

$directory = '/srv/myapp-private/uploads';
$name = bin2hex(random_bytes(16)) . '.pdf';

// Restrictive creation permissions for this dedicated endpoint.
umask(0077);

if (!move_uploaded_file($tmp, $directory . '/' . $name)) {
    http_response_code(500);
    exit('Upload failed');
}

// Save $name and the authenticated owner's ID in your database.
// Handle database failures and abandoned-file cleanup.

move_uploaded_file() can overwrite an existing destination. Random names greatly reduce accidental collisions; use an exclusive storage design when strict non-overwrite guarantees are required.

10. Which production settings are appropriate or risky?

Permission modes are examples, not universal values. The PHP worker, queue worker, scanner, and backup process may have different access requirements. Grant only the access each service needs.

11. Then what should happen after an upload?

1. Save metadata: Record owner, generated path, size, type, and processing status.
2. Quarantine when required: Mark the document unavailable until scanning or review succeeds.
3. Process safely: Use patched libraries and isolated workers with resource limits.
4. Authorize retrieval: Recheck the requesting user's permission every time.
5. Audit appropriately: Record access decisions without logging document contents or credentials.
6. Apply retention: Delete abandoned uploads and expired documents according to product requirements.
7. Protect backups: Private production storage is undermined by publicly exposed backups.
8. Verify boundaries: Test direct URLs, alternate users, expired access, invalid files, and failed storage writes.

Practical verification cases

12. Common questions

Why not use storage/app/public for everything?

It is intended for files that may be publicly accessible. Sensitive records need a different access path with authorization.

When is a random filename useful?

It avoids relying on client-controlled paths and reduces collisions. It does not grant or enforce download permission.

How does this relate to out-of-memory errors?

Private storage mainly addresses disclosure and code-execution exposure. Upload size limits, quotas, bounded processing, and worker resource budgets address availability and memory consumption. Both sets of controls are needed.

What if a malicious file passes validation?

Keep it outside executable locations, avoid interpreting it, and apply scanning or quarantine where required. Valid file formats may still contain harmful content or exploit vulnerable processors.

Does private mean encrypted?

No. Encryption at rest and key management are separate decisions. They do not replace authorization either.

References

• Original Debug School checklist, section 6
• Laravel filesystem documentation
• Laravel validation documentation
• PHP move_uploaded_file documentation
• Apache core directives
• Apache authorization directives
• OWASP File Upload Cheat Sheet

13. Colorful architecture: private storage and authorized downloads

The blue and green path accepts controlled uploads. The purple storage boundary keeps files outside direct web access. The orange decision checks each download. Red paths deny unauthorized access. Scanning is required only where the application's risk and policy call for it.

flowchart TD
    U["User uploads document"] --> V["Authenticate and validate — Type, size, quota, permissions"]
    V -->|Rejected| X["Reject request"]
    V -->|Accepted| Q["Quarantine and scan — When required"]
    Q -->|Failed| X
    Q -->|Approved| S["Private storage outside web root — Generated filename; never interpret as code"]
    V --> M["Database metadata — Owner, path, status"]
    D["User requests document ID"] --> A{"Authenticated and authorized? — Document approved?"}
    M --> A
    A -->|No| N["Deny download"]
    A -->|Yes| C["Download controller — Resolve stored path"]
    S --> C
    C --> R["Attachment response — Correct type; private cache policy"]
    W["Direct web request to private files"] --> B["Blocked by storage boundary — Apache denies direct access"]

    classDef blue fill:#dbeafe,stroke:#2563eb,color:#172554,stroke-width:2px;
    classDef green fill:#dcfce7,stroke:#16a34a,color:#14532d,stroke-width:2px;
    classDef purple fill:#f3e8ff,stroke:#9333ea,color:#581c87,stroke-width:2px;
    classDef orange fill:#ffedd5,stroke:#ea580c,color:#7c2d12,stroke-width:2px;
    classDef red fill:#fee2e2,stroke:#dc2626,color:#7f1d1d,stroke-width:2px;

    class U,D,W blue;
    class V,Q,C,R green;
    class S,M purple;
    class A orange;
    class X,N,B red;

Diagram rendering requires a Markdown platform with Mermaid support. If the blog platform does not support Mermaid, render the diagram to SVG or PNG before publishing.