# File storage location != public

**URL:** <https://www.ruby-forum.com/t/file-storage-location-public/89637>\
**Category:** Rails\
**Created:** [March 21, 2007, 7:51pm UTC](https://www.ruby-forum.com/t/file-storage-location-public/89637 "2007-03-21T19:51:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![wpwood](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/d6d6ee/32.png) [@wpwood](https://www.ruby-forum.com/u/wpwood)\
**Post date:** [March 21, 2007, 7:51pm UTC](https://www.ruby-forum.com/t/file-storage-location-public/89637/1 "2007-03-21T19:51:14Z")

</div>

My app allows visitors to upload XML files which I parse, store in the  
DB for review / modification, and then create a new XML file. I want to  
put the files somewhere other than RAILS\_ROOT/public so they’re not  
publicly visible during the visit. Like maybe RAILS\_ROOT/private. What  
would be really cool is if I could somehow _ensure_ that only the app  
had access to them. I’d appreciate hearing from anybody who’s got any  
experience with storing files like this. Any pointers? Any gotcha’s I  
need to look out for?

Thanks,  
Bill

---

<div class="post-metadata">

**Author:** ![wpwood](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/d6d6ee/32.png) [@wpwood](https://www.ruby-forum.com/u/wpwood)\
**Post date:** [March 21, 2007, 9:06pm UTC](https://www.ruby-forum.com/t/file-storage-location-public/89637/2 "2007-03-21T21:06:59Z")

</div>

Bill W. wrote:

> My app allows visitors to upload XML files which I parse, store in the  
> DB for review / modification, and then create a new XML file. I want to  
> put the files somewhere other than RAILS\_ROOT/public so they’re not  
> publicly visible during the visit. Like maybe RAILS\_ROOT/private. What  
> would be really cool is if I could somehow _ensure_ that only the app  
> had access to them. I’d appreciate hearing from anybody who’s got any  
> experience with storing files like this. Any pointers? Any gotcha’s I  
> need to look out for?

Two options.

1. you can stream the files with send\_file through a controller (I have  
a Docs controller that does this). This is easy enough for smallish  
files… like XML. But I guess there are memory and performance problems  
if you have to stream large media files.

2. You can use the same controller as above but instead of streaming  
with Rails, use the X-LIGHTTPD-send-file (or X-Sendfile depending on  
your web server) HTTP header to tell the web server to serve a file that  
isn’t in the document root.

For the latter, you’d need to set the content-type and  
content-disposition HTTP headers as appropriate.

-matthew