Introducing the Secret File System

Context

Community platforms like Open Social are very image heavy and can have a lot of rules around access to these images or other uploaded files. To manage access to non-public file Drupal's provides a private file system which performs access checking when the file is accessed and does not allow caching the response. This set-up can cause performance issues on pages with a lot of images that may be private, even if they're public for the specific page.

Secret File System

In 13.0.0, Open Social introduces the secret file system. This is a new StreamWrapper that creates a secret URL for a file with a limited validity. The structure of the URL ensures it's guess-resistant and its validity can easily be verified by a controller or external system. The controller handling the image view request provides cacheability information until the end of the URLs validity allowing the image to be served by a CDN.

Opting-out

Open Social will adopt the secret file system as its default for image fields for new installations and migrate existing platforms that currently use the private file system to use the new secret file system.

In case you have an existing platform that wishes to opt-out of the migration, you must set the social_group_group_type_migration_opt_out state to TRUE. This can be done using Drush:

drush state:set social_group_group_type_migration_opt_out TRUE

For new installations site builders are able to change the file system used on a per field basis.