Like @awzurn already explained, in the absence cookies one would need to to pass token through the URL (Signed URL). Ideally, that token would contain only per

Like @awzurn already explained, in the absence cookies one would need to to pass token through the URL (Signed URL). Ideally, that token would contain only permission to download that specific file for certain period of time. That said, one additional filter would have to be implemented to look for token in the URL. I believe that Amazon S3 is doing the same with signing URL requests for file download (http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CFPrivateDistJavaDevelopment.html http://docs.aws.amazon.com/AmazonCloudFront/latest/Developer... and http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentic...)