I'm looking at bringing over a feature from a previous MVC site that serves files based on our own simple custom authentication service.
Authenticated users (who simply have a authentication cookie saved) are able to download 'secure' files, served through a controller which checks their credentials and returns an unsecure media library link with content disposition set to 'attachment'. This is functional, but the media library files remain unprotected if users know the urls for the files.
Is it possible to use the secure media libraries for our purposes in such a scenario? Our users won't have distinct user rolls in the Kentico system; is it possible to spoof user rolls in the MVC app when we return urls from our controller?