- Can I install igorw/file-serve-bundle in a Laravel application?
- No. It is a Symfony2 bundle with a Bundle subclass, DI container extension, and kernel request listener, and it has no service provider, facade, config publish tag, or Illuminate coupling. Composer would try to resolve Symfony 2.x-era constraints against Laravel's Symfony 6/7 dependencies, likely causing a hard resolution failure or a downgrade cascade. Treat the repository as documentation and port the pattern instead.
- What does igorw/file-serve-bundle actually do?
- It serves static files through a Symfony application after PHP authorizes the request. It supports efficient delivery by handing the byte transfer to the web server through X-Sendfile with Apache mod_xsendfile or X-Accel-Redirect with an nginx internal location, so PHP-FPM never holds the file in memory. It is useful for protected downloads and streaming without exposing real disk paths.
- How do I implement protected file downloads in Laravel without this bundle?
- Use Laravel constructs for authorization and delivery. For small files and local development, response()->file() or streamDownload() is sufficient; for larger protected assets, implement a small FileDeliveryDriver that authorizes a path against a configured root and returns a response carrying the offload header. Bind the driver by environment so local uses streamed responses and production uses nginx X-Accel-Redirect.
- Does this package support Laravel 10, 11, or 12?
- No. The package targets the Symfony 2.0/2.1 era, and Symfony 2 reached end of life in November 2019. Laravel 10, 11, and 12 use Symfony 6/7 components, so this bundle is not compatible. A first-party port should target PHP 8.2+ and Laravel 10/11/12.
- How do I configure X-Accel-Redirect in Laravel for protected downloads?
- Configure an nginx internal location whose alias resolves the URI after X-Accel-Redirect: to the same inode as the Laravel-side disk root. The controller should authorize the requested path, then return a BinaryFileResponse-shaped response carrying the offload header. The highest-risk detail is path parity, including trailing-slash and percent-encoding behavior, so encode that parity in a feature test.
- What are alternatives to igorw/file-serve-bundle for protected file serving?
- Object storage with pre-signed URLs, such as S3 or GCS, is usually the best fit if assets can move because it needs no web-server changes and is CDN-friendly. In Laravel, URL::temporarySignedRoute() covers authorization-only needs, while nginx X-Accel-Redirect, Apache mod_xsendfile, and response()->file() or streamDownload() cover local and fallback cases. Choose based on whether you need authorization, bandwidth and memory offload, or both.
- Is igorw/file-serve-bundle maintained or safe to use?
- There has been no meaningful activity since roughly 2012-2013, Symfony 2 is EOL, and the package has zero dependents and no public bug surface. No security advisories will be issued, so any path-traversal, header-injection, or URL-encoding defect becomes your defect if you copy the logic. The MIT license permits a clean-room reimplementation of the roughly 150-250 lines of logic with your own test suite.
- Do X-Sendfile and X-Accel-Redirect support HTTP Range requests?
- A naive header shim can silently break Range requests, which matters for resumable downloads, streaming video, and large PDFs. The web server configuration and response behavior must be verified rather than assumed. If Range support is a requirement, add range-response tests or use streamDownload() or pre-signed object-storage URLs instead.
- How should I test a Laravel port of this file-serving pattern?
- Write feature tests for authorization failures, including IDOR, traversal, and encoding attempts, and assert that real disk paths are never exposed. Test path parity between the header URI and the Laravel disk root, including trailing slashes and percent encoding, plus missing files and range behavior if supported. Also add a startup assertion that the required nginx internal location or Apache module is available.
- What production risks should I check before using X-Accel-Redirect in Laravel?
- Confirm which web tier serves production, because a managed PaaS may not allow internal locations or mod_xsendfile. Check whether a CDN or proxy strips X-Accel-Redirect, which can produce empty 200 responses, and verify path and encoding parity with the Laravel disk root. If the requirement is only authorization, signed URLs or response()->file() may be simpler and safer.