This is a private file, I send to the web-browser through https link to that private file - but this file is publically accessible by this link. Should I add auth using header information that S3 will read? But I think that if somebody will take this link from memory - attacker also can steal a header too.
Name of file - md5 of content that was generated for that client. Also after one day this file will be automatically deleted.
UPDATE: in the normal workflow user will neither see nor operate in any way with this links - but can find them in developer tools of the browser.
UPDATE 2: thank you for related links, I read them, yes this questions quite relative, but specific of this question: 1) public files on Amazon S3 2) User do not see urls.
UPDATE 3: reading related questions I found possible scenarious:
1) Browser crash can send url to the third-party server (I am not sure but sound realistic).
2) User install some anti[virus]/proxy that send all HTTP call endpoints to the third-party servier (not sure about this too).