In reply to https://hacdias.com/2022/06/14/kzcvzhqtnw. You store them somewhere …

You store them somewhere that isn’t public and then use a bit of logic (a “controller” of sorts, which accepts a “file path” as a URL or query parameter and outputs binary [media] data) that serves them only to logged-in visitors? (And handles relevant headers, etc.)

[W]hat’s the best way to protect the media?