How do I stop people guessing or sharing my file download links?

Use cryptographically signed URLs that embed both the filename and an expiry timestamp.

The problem with the obvious approach. If uploaded files sit at predictable paths like /files/report.csv, then anyone who guesses or discovers the filename can download it. Directory-listing attacks, URL enumeration, and shared links that never expire are all routine ways that happens - and the last one is the quiet killer, because a link handed to one person keeps working for everyone it is forwarded to, forever.

What signing buys you. The signature makes the URL tamper-evident: change the filename to grab a different file, or extend the expiry to keep a link alive, and the signature no longer matches, so the URL is simply invalid. The expiry means a leaked or forwarded link goes stale on its own. Pick an expiry that matches the use case - hours to days - and generate a fresh signed URL each time a user asks for the file, rather than handing out one long-lived link.

For sensitive operations rather than files - anything destructive, or a privileged action triggered by a link - use a one-time token: valid for a single use, so replaying the request does nothing.

Note this is about authorization of the link. If the concern is bulk downloads overwhelming your server, that is a different problem with a different fix - serve them from edge object storage. Full items: https://www.tigzig.com/security/auth.