This project is not covered by Drupal’s security advisory policy.

Edge Private Files serves Drupal's private files from your CDN instead of PHP. Drupal still decides who may download each file, using core's exact access rules, and then hands the browser a short-lived signed URL. The CDN validates the token and delivers the bytes from its cache, so large PDFs, video and image galleries stop tying up PHP workers.

Signing providers are pluggable. Out of the box it supports Akamai EdgeAuth, Amazon CloudFront, Cloudflare, Fastly and nginx secure_link, and other modules can add their own.

Features

  • No markup changes: Existing /system/files/... links keep working. When one is requested, Drupal checks access and then redirects to a freshly signed edge URL. Tokens never end up in render-cached markup, so render caching and page caching keep working.
  • Exact core access semantics: Every hook_file_download implementation is respected, and a parity test suite checks that the module never allows a download core would deny.
  • Private image styles: Derivatives are validated and generated on demand before the redirect, so the edge always has something to fetch.
  • Authenticated origin: For edges that fetch from Drupal, a secret-protected origin endpoint supports Range and conditional requests, so PHP runs only on edge cache misses. Example configurations also cover serving directly from nginx, Apache or object storage, with no PHP at all.
  • Cache-friendly tokens: Expiry bucketing means repeated downloads within a short window reuse the same signed URL, and the provider guides show how to keep tokens out of the edge cache key.
  • Hardened delivery: Risky file types such as HTML and SVG are forced to download, with nosniff, a sandbox Content Security Policy and a no-referrer policy so tokens don't leak.
  • Edge invalidation: When a file changes or is deleted, Purge clears the edge copy using cache tags or paths.
  • Optional inline mode: A field formatter and a Twig function embed signed URLs directly in markup, with correct cache metadata, for galleries where a redirect per image is too costly.
  • Optional cookie realms: CloudFront and Akamai signed cookies can grant access to a whole directory, for use cases such as HLS video.
  • Secrets in the Key module: Signing keys and origin secrets never appear in exported configuration.
  • Diagnostics: Status report checks, plus drush edge-private-files:explain, which shows exactly how a given file would be delivered to a given user, and why.

Post-Installation

  1. Make sure the private file system is configured, then enable the module.
  2. Create Key entities for your provider's signing secret or private key, and for the origin secret.
  3. Configure your edge to validate tokens, exclude token parameters from its cache key, and fetch from your chosen origin. Ready-made configurations for each provider are in the module's examples/ directory.
  4. Go to Administration » Configuration » Media » Edge private files and add a delivery profile: pick a provider, set the edge base URL, choose which paths it covers and set the token lifetime.
  5. Check a file with drush edge-private-files:explain private://path/to/file.pdf --user=UID, then click a private file link and confirm it redirects to your edge hostname.

Additional Requirements

  • Drupal 10.3, 11 or 12.
  • The Key module.
  • A CDN or reverse proxy that can validate signed tokens: Akamai, CloudFront, Cloudflare, Fastly, or nginx with secure_link.

Recommended modules/libraries

  • Purge, with a purger for your CDN, to clear edge copies when files change.
  • S3 File System or Flysystem, if you want the edge to fetch private files straight from object storage.

Similar projects

  • CDN: Rewrites public file URLs to a CDN. Edge Private Files covers the private files that CDN leaves out, and the two work side by side.
  • CDN CloudFront Private: An API-only module for CloudFront signed URLs and cookies. Edge Private Files adds more providers, an admin UI, core access parity and render-cache-safe delivery.
  • Private File Token: Adds Drupal-validated tokens to private file URLs for decoupled sites. Drupal still serves every file itself; Edge Private Files moves delivery to the edge.

Known limitations

  • When access is revoked, for example by unpublishing a node, Drupal stops issuing tokens right away, but tokens it has already issued stay valid until they expire. The default lifetime is five minutes.
  • The edge can't deliver per-user headers that another module adds through hook_file_download. Files that need them fall back to normal PHP delivery.
  • Inline mode shortens render cache and page cache lifetimes to the token lifetime on pages that use it.
  • A cookie realm grants access to every file under its path prefix, so use it only for directories where every file has the same access rule.

Community Documentation

Documentation and example edge configurations: [link]

Project information

Releases