# How do I stop people guessing or sharing my file download links?

Use **cryptographically signed URLs** that embed both the filename and an expiry timestamp.

**The problem with the obvious approach.** If uploaded files sit at predictable paths like `/files/report.csv`, then anyone who **guesses or discovers the filename can download it**. Directory-listing attacks, URL enumeration, and shared links that **never expire** are all routine ways that happens - and the last one is the quiet killer, because a link handed to one person keeps working for everyone it is forwarded to, forever.

**What signing buys you.** The signature makes the URL **tamper-evident**: change the filename to grab a different file, or extend the expiry to keep a link alive, and the signature no longer matches, so the URL is simply invalid. The expiry means a leaked or forwarded link **goes stale on its own**. Pick an expiry that matches the use case - hours to days - and generate a **fresh signed URL each time** a user asks for the file, rather than handing out one long-lived link.

**For sensitive operations rather than files** - anything destructive, or a privileged action triggered by a link - use a **one-time token**: valid for a single use, so replaying the request does nothing.

Note this is about *authorization* of the link. If the concern is bulk downloads overwhelming your server, that is a different problem with a different fix - [serve them from edge object storage](https://www.tigzig.com/agents-faq/why-do-my-large-file-downloads-time-out). Full items: [https://www.tigzig.com/security/auth](https://www.tigzig.com/security/auth).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/how-do-i-secure-file-download-links
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms