File field download method: public files remain directly reachable after change

Changing a file field's download method to Private does not automatically restrict existing files. Because Drupal does not retroactively rewrite the URIs of previously uploaded files, any file already stored with a public:// scheme remains directly reachable via its web-accessible URL, bypassing Drupal's access control system entirely.

How Access Control Works for Private Files

When a file is correctly assigned the private:// scheme, Drupal handles the request differently than it does for public files:

• Streaming Route: Instead of the web server serving the file directly from a folder, the request is routed through Drupal's system/files (file download) route.
• Entity-Based Checks: Drupal verifies if the current user has permission to view the entity (node, user profile, etc.) that references the file.
• Hook-Based Control: Developers can use hook_file_download() to implement custom logic, returning -1 to deny access or 0 to allow it.

Server Configuration and the Web Root

The security of private files relies on the file system's inability to be accessed directly by a browser. If your $settings['file_private_path'] is located inside the web root, Drupal's internal access checks are insufficient on their own.

In this scenario, the web server must be explicitly configured to block direct requests to that directory. For example, Apache uses .htaccess rules, while Nginx requires a location block to return a 403 Forbidden or 404 Not Found. If these server-level rules are missing or ignored by a proxy/CDN, the files remain public regardless of the Drupal field setting.

Required Steps for Migration

To ensure sensitive uploads are protected after changing the field setting, you must manually migrate existing files:

1. Update URIs: Use the Migrate module, a custom script, or Drush to update the uri column in the file_managed table from public://path/to/file to private://path/to/file.
2. Move Physical Files: Physically move the files from the public files directory to the path defined in $settings['file_private_path'].
3. Verify Permissions: Test access using a non-privileged account to ensure the system/files route returns a 403 for unauthorized users.

Diagnostic Detail: Please specify your web server (e.g., Nginx, Apache) and whether your private path is currently outside the document root, as this determines which server-level blocks are required.