You should look into x-file-redirect. That way you can have a backend script handle the authentication and then let Nginx handle the streaming part if the user is allowed to download .