you may want to re-think your delivery method. how large are the files?
you could store the files below the web root and use PHP to stream the file dynamically. this would allow you to authenticate your user agains a database (or however you want to authenticate them)
when the user successfully authenticates, you can have php stream the file from below the web root directly to the user.
below is example code i found of php streaming a file.
PHP Code:
$filename = // your parameter
$filename = realpath($filename); //server specific
$file_extension = strtolower(substr(strrchr($filename,"."),1));
if (! file_exists( $filename ) )
{
die("NO FILE HERE";
};
switch( $file_extension )
{
case "pdf": $ctype="application/pdf"; break;
case "exe": $ctype="application/octet-stream"; break;
case "zip": $ctype="application/zip"; break;
case "doc": $ctype="application/msword"; break;
case "xls": $ctype="application/vnd.ms-excel"; break;
case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
case "gif": $ctype="image/gif"; break;
case "png": $ctype="image/png"; break;
case "jpe": case "jpeg":
case "jpg": $ctype="image/jpg"; break;
default: $ctype="application/force-download";
}
header("Pragma: public"); // required
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: private",false); // required for certain browsers
header("Content-Type: $ctype");
header("Content-Disposition: attachment; filename=".basename($filename).";" );
header("Content-Transfer-Encoding: binary");
header("Content-Length: ".@filesize($filename));
@readfile("$filename") or die("File not found.");
exit();
?>