How to Fix an Exposed Laravel Storage Directory

The Problem

How to Fix

1. 1

   Verify your document root

   The most common cause of an exposed storage directory is an incorrect document root. Your web server must point to /public, not the project root:

   # Nginx - correct
   root /var/www/yourapp/public;

   # Nginx - WRONG, exposes storage/
   root /var/www/yourapp;

   With the correct document root, the storage directory is outside the web-accessible path and cannot be accessed directly.

2. 2

   Remove or secure the storage symlink

   The php artisan storage:link command creates a symlink from public/storage to storage/app/public. Only files in storage/app/public should be web-accessible.

   Check what the symlink points to:

   ls -la public/storage

   It should point to ../storage/app/public, not ../storage. If it points to the wrong location, recreate it:

   rm public/storage
   php artisan storage:link

   Never store private files in storage/app/public. Use storage/app/private/ for sensitive uploads.

3. 3

   Block direct access to storage paths

   Add web server rules to block access to storage directories that should not be public. In Nginx:

   location ~* ^/storage/(app|framework|logs) { deny all; return 404; }

   In Apache .htaccess:

   RewriteRule ^storage/(app|framework|logs) - [F,L]

   This ensures only public/storage (the symlink to storage/app/public) is accessible.

4. 4

   Serve private files through a controller

   For files that require authentication, serve them through a Laravel controller instead of direct file access:

   Route::get('/files/{path}', function (string $path) {
       $fullPath = storage_path('app/private/' . $path);

   if (!file_exists($fullPath)) { abort(404); }

   // Add authorization check
       // abort_unless(auth()->user()->canAccessFile($path), 403);

   return response()->file($fullPath);
   })->middleware('auth')->where('path', '.*');

How to Verify

curl -I https://yourdomain.com/storage/logs/laravel.log
curl -I https://yourdomain.com/storage/framework/sessions/
curl -I https://yourdomain.com/storage/app/

Prevention

Frequently Asked Questions