In general the "best" solution here is to have URLs with a time-limited token. S3 and the likes make this pretty easy to set up, but there's no reason you could

In general the "best" solution here is to have URLs with a time-limited token. S3 and the likes make this pretty easy to set up, but there's no reason you couldn't roll your own solution.