Generating Public URLs for Laravel Storage Files

When Laravel stores a file, it saves the file in a location and uses a URL to let a browser retrieve it. Laravel groups storage settings into disks, named configurations that specify where files go and which storage driver to use. A disk might point to a local directory or an Amazon S3 bucket. To make a local file public, store it on the public disk and configure the web server to serve that disk’s directory. Then generate a URL for the file.

The php artisan storage:link command links Laravel’s public web directory to its public storage directory. Then Storage::disk('public')->url($path) builds a URL using the disk’s settings. The URL points to the file. The link and storage permissions determine whether a visitor can retrieve it.

Link the local public disk to the web directory

Laravel’s default local public disk saves files in storage/app/public. The storage:link command creates a symbolic link, a filesystem reference that makes files in that directory available through Laravel’s web-facing public directory. By default, the link maps public/storage to storage/app/public.

Run the command once in the deployed application:

php artisan storage:link

Store a file on the public disk and use its returned path to generate a URL:

$path = $request->file('avatar')->store('avatars', 'public');

$url = Storage::disk('public')->url($path);

If Laravel stores the file as avatars/example.jpg, the default local setup typically produces a URL ending in /storage/avatars/example.jpg. For the URL to work, the web server must serve the application’s public directory and follow the symbolic link to the stored file. You can configure more links in config/filesystems.php; the command creates each link listed there. The Laravel filesystem documentation explains the public disk and link settings.

Generate URLs from the selected disk

Storage::disk('public')->url($path) asks Laravel’s filesystem adapter to build a URL from the selected disk’s settings. A local disk typically returns a path under /storage. An S3 disk returns a full URL for the remote file. Disk settings can also set a custom URL base, such as a CDN host. The selected disk and its settings determine the URL.

For a local file already exposed at the conventional /storage path, Laravel’s asset helper is another option:

$url = asset('storage/' . $path);

This builds a URL for the asset at that path. Use the disk’s url() method when the storage backend or URL base can vary. The method builds the URL using the selected disk’s settings.

Generating a URL does not make a file public. For local storage, the linked public directory must make the file reachable. For remote storage, the provider’s access settings must allow the intended retrieval. Laravel’s public visibility setting describes whether a file is generally accessible, but provider policies and settings also affect access. The filesystem documentation notes that local url() output is not URL-encoded. Store filenames that form valid URLs, or handle unusual characters deliberately.

Keep private files behind controlled access

The standard public/storage link does not expose files on a private disk. Laravel’s default local local disk stores files under storage/app/private, outside the linked public directory. Knowing a private file’s path does not give a visitor permission to retrieve it; the visitor needs an access method that allows retrieval.

For user-specific files, a route can check whether the logged-in user has permission before returning the file or a download response. Laravel also supports temporary URLs for local and S3 disks when the selected disk supports them. A local disk may need serve => true in its settings to serve temporary URLs.

A temporary URL expires, but anyone with the link can access the file until it expires. Use one when a time-limited shared link meets the access requirement. If access depends on a particular user’s authorization, check that authorization before returning the file. Laravel also supports signed and temporary signed URLs. A signature helps detect URL changes and enforce expiration, but it does not replace an application-specific permission check. See Laravel’s documentation on signed URL generation.

What I'm building

Delegate tasks. Get software.

Give Vroni a GitHub issue, bug report, spec, or rough idea. It reads the repo, plans the change, writes code, runs checks, and works toward a review-ready pull request.

Take a look at vroni.com