Does disabling Public Links immediately revoke existing unauthenticated file URLs in Mattermost?

Short answer

Not confirmed. Clearing Enable Public Links in the Mattermost System Console is expected to block existing public links on their next request, but Mattermost does not document guaranteed, instant revocation for every version and edition. Treat the toggle as likely effective, not proven, until you verify it on your server.

Confirmed facts versus likely explanation

Item	Status	Notes
Enable Public Links governs creation of new public links	Confirmed	Turning it off stops new links from being issued.
Public Links Admin Only restricts who can create links	Confirmed	It does not change the fate of links issued before the setting changed.
Older links may lack an expiration timestamp	Confirmed	Links created before expiration policies were applied can persist unless the server checks the feature flag on read.
Disabling invalidates all existing links immediately	Likely, unverified	Expected if Mattermost enforces the flag on each public-link request; not explicitly documented across all releases.
Behavior varies by version and edition	Likely	Possible differences across releases and between Team and Enterprise self-hosted editions.

Verification steps

1. Open an existing public file link in a private window and confirm the file downloads.
2. In the System Console, clear Enable Public Links and save the change.
3. Open the same link in a new private window. A 403 or 404 response indicates read-time enforcement; a successful download means the link is still valid.
4. Review the Mattermost server log around the retry for public-link rejection messages.
5. Confirm the System Console reflects the disabled setting without a server restart.

If the link still works, do not rely on the toggle as revocation. Remove the link or restrict access to the underlying file through whatever controls your Mattermost version exposes.

Missing diagnostic detail

Which Mattermost version and edition are you running? Version and edition can change how public links are enforced, so this detail determines whether the steps above are sufficient or whether you need a different revocation path.

Assumptions and caveats

• This assumes self-hosted Mattermost with System Console access.
• Browser or proxy caching may serve stale content briefly after the server begins rejecting the link.
• Disabling the setting does not delete link records from the database; it only affects request handling if the flag is checked at read time.