I see.

Well, I don't think you will be able to achieve anything via IIS without having to sync DNN authentication with Active Directory and that definitely introduces another point of possible break...

You might be able to set up just one page, though, that would act as a semaphor for file display inside an IFrame module while still hiding the real url from malicious users. You could have IFrame point to, say, iframeshow.aspx and pass to it an id of the file that should be displayed. Insude iframeshow.aspx you could check if the user is authenticated and, if they are, pull up the file url from some datasource - XML, DB, CSV, you name it! Then your server side code would read that file and push it to the user as BinaryStream. In that case, the real url will be completely hidden from users.

Hey, my pleasure! By the way (no pressure) - feel free to share your code with us, may be others will be able to benefit from such a setup or, may be, we'll be able to include it in the module somehow... But don't feel obligated :)