News

Announcing File Gate

Wilkes & Liberty has open-sourced File Gate, a Drupal module that gates private files for any front end — available now on drupal.org.
— July 13, 2026
Topics:Access Control
Tags:DrupalPHP

We've released File Gate, a free and open-source Drupal module that makes a "private" file genuinely gated — for decoupled, coupled, and hybrid sites alike. It's available now on drupal.org.

Why we built it

Drupal grants a private-file download to anyone who can view the content that references it. Because anonymous visitors can view published content, a private:// file attached to a published page is effectively public to anyone with the link — private:// means "not sitting in a public directory," not "gated." That gap is exactly what bites lead-gen documents, gated reports, and paywalled deliverables, and it's sharpest on a headless site, where the gate (a form, a login, a purchase) lives in a different system from the file.

We hit it building the decoupled platform behind wilkesliberty.com, and rather than solve it once, we built the fix as a reusable module and gave it back to the community.

What File Gate does

  • Denies the raw path. A hard veto on /system/files for any private file a gated field references — overriding core's permissive private-file access.
  • Delivers through a signed route. The bytes stream from the module's own endpoint only after a pluggable gate method approves the request, and the signed URL carries the file's UUID — never its storage path.
  • Mints server-to-server. Your back end passes your gate however you like, then asks Drupal for a short-lived, HMAC-signed URL for one specific file. The secret never reaches the browser.
  • Fails closed. With no signing secret configured, the module refuses to mint and every gated file stays denied — a misconfiguration produces a visible failure, not a silent leak.
  • Front-end agnostic. Nothing about React, Next.js, Vue, or a coupled Twig theme is assumed. It works anywhere Drupal does.

Get it

File Gate requires Drupal 11.4+ and a private file system. Install it with Composer:

composer require drupal/file_gate

The current release is 1.6.1, released under the GPL-2.0-or-later license. For the full picture, read the open-source overview File Gate and the engineering whitepaper Gating Private Files in a Headless CMS.