> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Temporary Local File URLs!
- URL: https://securinglaravel.com/security-tip-temporary-local-file-urls/
- Published: 2025-04-01T03:22:01.000Z
- Updated: 2025-04-01T03:22:01.000Z
- Description: [Tip #108] Temporary URLs for file access is an essential piece of the security puzzle, which up until recently were only available out-of-the-box for the S3 driver. Now you can easily generate them for local files too!
- Author: Stephen Rees-Carter
- Tags: Security Tips, Laravel 12, File Uploads, Leaking Data, Authorisation

I'm sneaking this one into our series on security-related changes in [Laravel 12](https://securinglaravel.com/tag/laravel-12/), even though it actually comes from Taylor Otwell's [Laracon 2024 PR](https://github.com/laravel/framework/pull/52710/commits/65556fa0a43d6cb72ea7c56ee4f6899d05b397f7?ref=securinglaravel.com#diff-d13f2f975acd8ea9628a4e285edec45241a2b3142bfe3decd02fd47748007eaa) in September 2024\. It's close enough, right? 😉

Way back in January 2023 I wrote about [Restricting Local File Access](https://securinglaravel.com/security-tip-restricting-local-file/) due to Laravel only supporting temporary URLs for files stored on external `s3` driver file systems. My solution was to set up a custom signed route which allowed you to securely serve local files with temporary [signed URLs](https://securinglaravel.com/tag/signed-urls/).

Well, as of that September 2024, you can now do it directly within the Storage system in Laravel! No need for a custom route any more. 🎉

The process is now the same regardless of if you're using the `s3` or `local`:

```php
use Illuminate\Support\Facades\Storage;
 
$url = Storage::temporaryUrl(
    'file.jpg', now()->addMinutes(5)
);
```

That's it. Laravel does the rest for you automatically, just the way we like it. 😁

The only caveat is that you will need to enable it via `disks.local.serve=true` in your `config/filesystems.php` file, if your app doesn't have the new config option:

```php
'local' => [
    'driver' => 'local',
    'root' => storage_path('app/private'),
    'serve' => true,                          // <<< Add & set true
    'throw' => false,
],
```

[Checkout the docs for the full details](https://laravel.com/docs/filesystem?ref=securinglaravel.com#temporary-urls), including customising the temporary URL generate and/or route if needed.

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* 

*You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*