This question already has an answer here:
I'm trying to create a simple download system as a part of my website. Is there anything insecure in this route:
Where user_id and code are optional for files that are free to download. Otherwise, after a payment I generate a unique code/secret for a user and provide him a link.
Is there room for improvement here? And are there vulnerabilities?
It's not just a random url
There'll also be "expire_date" associated with each secret.