Validate an uploaded image and store it through a configured disk
A profile-photo endpoint needs more than a filename ending in .jpg. The upload must satisfy size and content rules, be stored under an application-controlled name, and be served according to the intended visibility.
Validate before storing
$request->validate([
'photo' => ['required', 'image', 'max:2048'],
]);
$path = $request->file('photo')->store('profile-photos', 'public');
The size limit here is expressed in kilobytes by Laravel's file validation rules. The public disk must be configured correctly on the host. Store the returned relative path rather than constructing a path from the original user filename.
Public and private files need different flows
A profile photo may be public. A customer invoice or identity document usually needs a private disk and an authorized download route. Moving every upload into the public directory to fix one broken image can expose unrelated private files.
When replacing an image, consider the order of operations. Save the new file, update the record successfully, and remove the old file only when it is no longer referenced. A failed database save should not leave the record pointing to a deleted image.
Test an acceptable image, a renamed non-image, an oversized file, and a storage failure. Verify the generated public URL on the actual hosting configuration: existence on disk does not prove the web server can read it. File permissions, document roots, and symlinks can each produce a missing-image symptom.