I've wondered about that on several sites. So it's true that it still requires: a) a user who should have the URL give it to them or b) person 1 guessed the

I've wondered about that on several sites. So it's true that it still requires: a) a user who should have the URL give it to them or b) person 1 guessed the URL, like a password since it's usually a long url with a GUID of some type. But is that acceptable for some reason? Easier development? Because otherwise you need to: a) issue one time/short lived token for accessing an image on S3 for instance, for all the images that will be shown on a page when a page loads for an authenticated user. or b) proxy the image requests by making an api endpoint for image names, authenticate those requests, fetch the image from a place only the server has access to and stream the image data back.