Download URL contains secrets.

[illegalprime]

Currently when one logs in and presses the download button, they can then take that link and use it anywhere (even when they are not logged in!). This is cannot be used if this bug exists, we don't want to leak info.

[illegalprime]

It's also seen as a pop-up by chrome which is not good. (because of the different host I guess)

[illegalprime]

@Anish2
Maybe this is outdated by now, is it a timeout link or a one-time link generated by S3?
I think just forget all these S3 generated links and have the server retreive the file not the client.
This is because if you give the client the link it might not load it in time to pass the timeout or it might retry to load it and fail from the one-time link.
Also be sure to disable Cloudflare's caching for sensitive information.

Thanks!