Most Secure Way to Store Uploaded Files
symfony
Solution
It's preferred to keep uploaded files outside of the web directory and use `X-SendFile` to serve those files after you established the access permissions using PHP.
I've outlined something similar here: How to securely store files on a server
And here: Caching HTTP responses when they are dynamically created by PHP
Problem
I store uploaded files in the web directory: ``` //src/Acme/CocoBundle/Entity/CocoFromTheNorth.php /** * @ORM\Column(type="string", length=255, nullable=true) */ public $path; protected function getUploadRootDir() { return __DIR__.'/../../../../web/'.$this->getUploadDir(); } protected function getUploadDir() { return 'uploads/documents'; } ``` Is this a good practice? Wouldn't it be better to keep uploaded files outside the web directory so that they cannot be directly accessed by the users? Am I right to think that the best way would be to store uploaded files outside of the web root? Where would it be the best then? Or how could I configure the web server to deny access to the uploads directory?