I'm creating a website where I want users to be able to login. I'm using https://craftcms.com/docs/templating/login-form to achieve this. No problem so far.

When a user is logged in, I want the user to be able to reach the asset folder (depending on what the rights are for his user-group). When not logged in, I want the asset url to be private. For this to work I've placed the asset folder outside the webroot, so you can't access the asset folder by default.

I've tried to achieve this with this plugin: https://github.com/tikiatua/internal-assets-plugin But without any success.

My general config:

'enableTemplateCaching' => false,
    'devMode' => true,
    'siteUrl' => 'http://website.loc/',
    'loginPath' => 'http://website.loc/',
    'environmentVariables' => array(
        'internalAssetsPath' => CRAFT_BASE_PATH . "../media/",
        'internalAssetsUrl' => "http://website.loc/media/"

I can upload a image in my internalAssetsPath, but when I try to show this in front-end, I get a 404.

{% for image in craft.assets.kind('image') %}
        <li><img src="{{ image.getUrl() }}" alt="{{ image.title }}"></li>
{% endfor %}

A solution for the 404 problem would be nice, but a solution for reaching the asset folder when logged in would be great.


Give Digital Download a try... it generates a masked URL for downloadable assets. You can restrict the download to a specific user or user group.

Disclaimer: I'm the plugin author.

  • Does it prevent direct access to the files? – ponies Aug 4 '20 at 0:33
  • Yes, you can use the plugin with non-public files. – Lindsey D Aug 4 '20 at 2:42

Make sure that your /craft/config/general.php has the right reference to the plugin. If you have 'internalAssetsUrl' => "http://website.loc/media/", then you need to change the InternalAssetsPlugin.php-file from

return array(
'internal/(?P<id>.\d*)' => array('action' => 
'internal/(?P<directory>.*)/(?P<name>.*)' => array('action' => 


return array(
'media/(?P<id>.\d*)' => array('action' => 'InternalAssets/Assets/download'),
'media/(?P<directory>.*)/(?P<name>.*)' => array('action' => 

in other words, just change 'internal' to 'media'.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.