- What is mostafaznv/php-x-sendfile used for?
- It serves large files by sending X-Sendfile or X-Accel-Redirect headers so Apache or Nginx handles the actual download. This keeps PHP memory usage and execution time low compared with streaming files through PHP. It works with Laravel applications and plain PHP projects.
- How do I install mostafaznv/php-x-sendfile in Laravel?
- Install it with Composer using composer require mostafaznv/php-x-sendfile. Laravel auto-discovery should register the package service provider, and you can publish any package configuration if the package provides it. Configure your web server to honor X-Sendfile or X-Accel-Redirect before testing downloads in staging.
- Which Laravel and PHP versions does php-x-sendfile support?
- The package is intended for modern Laravel applications and plain PHP projects, but you should confirm the exact PHP and Laravel constraints in the package composer.json and README. Release 1.1.0 adds custom project-root support, so check that version if you need non-standard deployment paths. Verify compatibility in a development branch before upgrading production.
- How do I configure Nginx for X-Accel-Redirect?
- Nginx needs an internal location that maps the URI sent in the X-Accel-Redirect header to the protected file path. Mark that location internal so clients cannot request it directly, and make sure the path and permissions match what the package sends. Test with a large file and check Nginx error logs if the download fails.
- Do I need mod_xsendfile for Apache?
- Yes, Apache must have mod_xsendfile enabled and configured to process X-Sendfile headers. Without it, Apache will return the header to the client instead of serving the file. Confirm the module is loaded and that the directory containing your files is readable by the Apache user.
- How does the custom project root in version 1.1.0 work?
- Version 1.1.0 adds an option for a custom or absolute project root path for deployments where Laravel default base_path or working-directory assumptions do not match the package runtime context. It is intended as an additive, opt-in setting while the default root behavior stays unchanged. Use it for monorepos, containers, custom document roots, or shared hosting, and validate the path in staging first.
- Can I use php-x-sendfile without Laravel?
- Yes, the package supports plain PHP as well as Laravel. You use it to emit the appropriate X-Sendfile or X-Accel-Redirect response headers from your PHP script. You still need the matching Apache or Nginx configuration and correct filesystem permissions.
- Is it safe to serve files outside the public web root with X-Sendfile?
- X-Sendfile and X-Accel-Redirect are commonly used to serve files outside the public web root because the web server performs the file read after PHP authorizes the request. You must still implement authentication and authorization in PHP before sending the header. Also ensure the internal Nginx location or Apache path cannot be requested directly by clients.
- How do I test php-x-sendfile locally without Nginx or Apache support?
- X-Sendfile requires web server support, so a local PHP built-in server will not process the header and may return it without the file. Use a local Nginx or Apache environment that mirrors production, such as Docker or Laravel Sail with the required module or internal location. You can also unit-test the header generation logic separately from the actual file transfer.
- What are the production risks of using a custom absolute project root?
- Absolute paths can cause environment-specific configuration drift, symlink or path-normalization issues, and permission failures. Make sure the root is set consistently across HTTP, CLI, queue workers, and scheduled tasks, and clear Laravel config cache after changes. Prefer deployment-level configuration and keep a rollback to the default root if downloads fail.