Protecting static files from non logged in users in Django

Question

I have an existing site with a number of documents being served staticly. Client wants to add login protection to the site - not a problem using django_auth. However, the files being served from apache are still downloadable?

Is there a way to restrict access?

Ideally, this would require the path to these docs not changing on the site.

Was thinking of removing the alias from the apache config and having that route to a view that has the @login_required decorator on it, and then forwarding on.

Answer 1

See Having Django serve downloadable files on how to set up Django to work with Apache X-Sendfile. You can wrap the X-Sendfile header sending with some authentication checks and you should be good to go.