Generating Temporary Storage URLs in Laravel

When Laravel code stores a file that should stay private, it can give a recipient a temporary URL instead of a permanent public link. Anyone with the link can access the file while the link is valid, subject to the storage driver’s rules.

Laravel’s Storage facade, which provides access to configured file storage, creates these links with temporaryUrl(). A disk is a named storage configuration, such as a local folder or an Amazon S3 bucket. Laravel can create a temporary URL when the selected disk supports them or you have configured a custom URL generator. The storage driver determines how it signs and serves the link.

Generate a temporary URL for a file

Pass the file’s storage path and an expiration time to temporaryUrl():

use Illuminate\Support\Facades\Storage;

$url = Storage::disk('s3')->temporaryUrl(
    'private/reports/report.pdf',
    now()->addMinutes(10)
);

now()->addMinutes(10) sets the URL to expire ten minutes from now. Laravel documents native temporary URL support for the local and s3 disks. Laravel asks the selected storage driver to create the URL. If the driver does not support temporary URLs and you have not configured a custom generator, Laravel throws a runtime exception. Check the disk your code actually uses rather than assuming every driver supports the method. See Laravel’s file storage documentation and filesystem adapter implementation.

The storage driver determines how Laravel creates and serves the URL. For S3, Laravel asks the adapter to create a presigned URL: a request signed with storage credentials and limited by those credentials’ permissions. For a local disk, Laravel can create a temporary signed route, a Laravel URL with a signature and expiration, to serve the file. The local disk needs the serve option enabled for the documented built-in behavior:

'local' => [
    'driver' => 'local',
    'root' => storage_path('app/private'),
    'serve' => true,
],

Some existing local-disk configurations need this setting added. It applies to the local disk, not to every storage driver. For S3, Laravel also accepts request parameters as a third argument, such as settings that control the response content type or download disposition. The details appear in the Laravel filesystem documentation.

What the signature and expiration enforce

A signature helps detect changes to the URL data covered by it. For a Laravel temporary signed route, Laravel includes a signature and an expiration timestamp, then checks that the signature is valid and the timestamp has not passed when the recipient requests the URL. An S3 presigned URL uses the storage provider’s request-signing mechanism instead. In either case, possession of the link grants access under the link’s rules; the signature does not, by itself, authenticate the recipient as a particular Laravel user. Laravel describes validation of temporary signed routes, and AWS warns that presigned URLs act as bearer tokens.

A temporary URL is not automatically single-use. An S3 presigned URL can be used repeatedly until it expires. Use an additional authorization layer, such as an authenticated Laravel route that checks access before serving the file, when recipients must prove their identity or access must depend on their current account permissions. Use the same layer if the link must stop working immediately.

For S3, the URL stops working when either its expiration arrives or its underlying credentials expire, whichever happens first. AWS documents a maximum of up to seven days for URLs created with eligible CLI or SDK credentials; temporary credentials impose their own, shorter ceiling when they expire sooner. S3 checks expiration when each request begins, so a download started before expiry can continue, while a later retry can fail. These are S3 rules, not universal Laravel limits. Choose an expiration that fits the intended access window and the credentials used to sign the URL.

Use public URLs for files meant to stay public

Use a permanent public URL when anyone should be able to access the file without a time limit. For Laravel’s local public disk, files live under storage/app/public, and a symbolic link from public/storage makes them web-accessible. Depending on the disk, Storage::url() returns a file URL or path without adding an expiration or making a private file access-controlled. Laravel documents the public disk and URL methods.

Use temporaryUrl() to give someone time-limited access to a file that should remain private. Use a public URL only when anyone should have access. Treat a temporary link as sensitive: anyone who obtains it can use it while it remains valid.

If a disk lacks native temporary URL support, Laravel’s buildTemporaryUrlsUsing() method lets you define a custom URL generator. For example, the generator can create a temporary signed route. Your application must still provide the route that checks the signature and expiration and serves the intended file safely. The callback creates the URL; it does not make an unsupported driver serve files automatically.

What I'm building

Delegate tasks. Get software.

Give Vroni a GitHub issue, bug report, spec, or rough idea. It reads the repo, plans the change, writes code, runs checks, and works toward a review-ready pull request.

Take a look at vroni.com