This question already has an answer here:
I have noticed that my private Google Drive resources, for example, although it is impossible to "guess" their hash-key and get it (eg tbEB6fQTqQcFAoRBXYvnpNVq9F3PUr_cs), however the server requires authentication to access the resource.
On the other hand, in ICloud I saw that while there is an "external" link that represents each resource, it is private, but the real address (by which the client-side goes the resource) is without any authentication .
I think that makes sense, that there is no way for an attacker to obtain the key in Query String, because it is encryped by SSL.
The question is whether there is any fear of it and therefore to implement validation as Google does. I'm talking about an application where resources are not exposed in any way to an unauthentication user.