Tata wrote:cmb wrote:And even then, anybody who's able to get the URL of the PDF is able to download it "manually".
By full names of the documents it's not very likely to write the path correctly.
One does not even have to write the path. Clicking on the URL in the browser's development tools suffices, for instance. Note that there is no protection from downloading anything that is presented as IFrame. But as you've already mentionend, there are other techniques which can be sufficient.