Folders permissions in Laravel

Great question! File and folder permissions are critical for both security and functionality in Laravel projects.

Best Practice for Laravel Folder Permissions

Laravel needs write access for the storage and bootstrap/cache directories. The rest of your project should not be writable by the web server.

Recommended Approach

1. Ownership

• The web server (often www-data on Ubuntu) must be able to write to storage and bootstrap/cache.
• It's safest if your user owns the files, but the web server group (www-data) has write access to only the necessary directories.

2. Permissions

• Set the group ownership of storage and bootstrap/cache to the web server group.
• Give group write permissions to these directories.

Commands:

# Set your user as owner, and www-data as the group
sudo chown -R $USER:www-data /path-to-your-project

# Set group write permissions only for storage and bootstrap/cache
sudo chmod -R 775 /path-to-your-project/storage
sudo chmod -R 775 /path-to-your-project/bootstrap/cache

Explanation:

• chown -R $USER:www-data ... makes your user the owner (so you can edit files easily), and the web server group can write where needed.
• chmod -R 775 ... allows the owner and group to read/write/execute, but others can only read/execute.
• Do not make the entire project writable by the web server. Only storage and bootstrap/cache need this.

Never use 777 permissions unless you are in a non-production, isolated environment (e.g., local development and you understand the risks).

Summary Table

Directory	Owner	Group	Permissions
All except storage/cache	your user	www-data	755
storage, bootstrap/cache	your user	www-data	775

Commands to set 755 for all except storage/cache:

sudo find /path-to-your-project -type d -exec chmod 755 {} \;
sudo find /path-to-your-project -type f -exec chmod 644 {} \;

Then set 775 for the writable directories as above.

---

In summary:
The second approach ($USER:www-data with 775 only on necessary folders) is safer and more flexible, especially for development. For production, you may want to be even more restrictive, depending on your deployment strategy.

References:

• Laravel Docs: Deployment
• OWASP File Permissions Cheat Sheet

Let me know if you have further questions!