Securing file download links

Question

As per the File upload/download How-to at http://download-west.oracle.com/docs/cd/B19306_01/appdev.102/b14377/up_dn_files.htm#sthref153
downloading a file involves writing a stored procedure and invoking it directly using the DAD and mod_plsql. For example, /pls/htmldb/owner.procedure?p_file_id=1234
This link bypasses the Apex show engine so even if I have all the security in the world in Apex using authentication schemes, authorization schemes, etc, a authenticated user in Apex can just right click on the Download link, shoot it off to someone else who can download the file without even logging in to my application!
How can these "download links" be secured so that only authenticated users can access them only from an Apex session?
Thanks

Answer 1

Thank you Vikas.
The reason I ask is I get a compilation error in my procedure.
I am no PL/SQL expert so I am sure my syntax or logic is wrong.
I am using APEX version 2.0
Error(7,19): PLS-00103: Encountered the symbol "." when expecting one of the following: constant exception <an identifier> <a double-quoted delimited-identifier> table LONG_ double ref char time timestamp interval date binary national character nchar The symbol "<an identifier>" was substituted for "." to continue.
CREATE OR REPLACE PROCEDURE download_my_file(p_file in number) AS
        v_mime  VARCHAR2(48);
        v_length  NUMBER;
        v_file_name VARCHAR2(2000);
        Lob_loc  BLOB;
        APEX_APPLICATION.G_FLOW_ID := 100;
BEGIN
--testing security
IF NOT wwv_flow_custom_auth_std.is_session_valid then
    -- display this message or a custom message.
htp.p('Unauthorized access - file will not be retrieved.');
    -- You can do whatever else you need to here to log the
    --     unauthorized access attempt, get the requestor's
    --     IP address, send email, etc.
    RETURN;
END IF;
        SELECT MIME_TYPE, BLOB_CONTENT, name,DBMS_LOB.GETLENGTH(blob_content)
                INTO v_mime,lob_loc,v_file_name,v_length
                FROM file_subjects
                WHERE id = p_file;
              -- set up HTTP header
                    -- use an NVL around the mime type and
                    -- if it is a null set it to application/octect
                    -- application/octect may launch a download window from windows
                    owa_util.mime_header( nvl(v_mime,'application/octet'), FALSE );
                -- set the size so the browser knows how much to download
                htp.p('Content-length: ' || v_length);
                -- the filename will be used by the browser if the users does a save as
                htp.p('Content-Disposition:  attachment; filename="'||replace(replace(substr(v_file_name,instr(v_file_name,'/')+1),chr(10),null),chr(13),null)|| '"');
                -- close the headers           
                owa_util.http_header_close;
                -- download the BLOB
                wpg_docload.download_file( Lob_loc );
end download_my_file;
/Thanks
VC