Laravel File Upload Security: How to Validate Type, Size, and Storage Location

The Problem

How to Fix

1. 1

   Validate file type using mimes and mimetypes rules

   Always validate the actual file type, not just the extension:

   $request->validate([
       'avatar' => 'required|file|mimes:jpg,jpeg,png,webp|max:2048',
       'document' => 'required|file|mimetypes:application/pdf|max:10240',
   ]);

   The mimes rule checks the file extension. The mimetypes rule checks the actual MIME type by reading the file content. Use both for maximum safety:

   'photo' => 'required|file|mimes:jpg,png|mimetypes:image/jpeg,image/png|max:5120',

2. 2

   Set a maximum file size

   Always enforce a size limit to prevent denial of service:

   // In validation rules (size in kilobytes)
   'file' => 'required|file|max:10240', // 10 MB max

   // Also set PHP limits in php.ini
   upload_max_filesize = 10M
   post_max_size = 12M

   Set limits appropriate to your use case. Profile photos need 2 MB at most; documents might need 10 MB.

3. 3

   Store uploads outside the public directory

   Never store uploads directly in public/. Use Laravel's storage system:

   // Store in storage/app/uploads (not publicly accessible)
   $path = $request->file('document')->store('uploads');

   // If you need public access, use the public disk with a unique name
   $path = $request->file('avatar')->store('avatars', 'public');

   // Generate a unique filename to prevent overwriting
   $path = $request->file('avatar')->storeAs(
       'avatars',
       Str::uuid() . '.' . $request->file('avatar')->extension(),
       'public'
   );

4. 4

   Disable PHP execution in upload directories

   Even with validation, add a defense-in-depth layer by disabling PHP execution in upload directories.

   Nginx: location ~* /storage/.*\.php$ { deny all; return 404; }

   Apache (.htaccess in storage/app/public/):
   php_flag engine off
   <FilesMatch "\.php$">
       Order allow,deny
       Deny from all
   </FilesMatch>

How to Verify

# Create a test PHP file
echo '<?php phpinfo();' > test.php.jpg

# Try uploading via your form — it should be rejected

Prevention

Frequently Asked Questions