Sharepoint 2013 delivers documents through IIS too good! Need to restrict by logged in user

Question

I have a Sharepoint 2013 app that lets external users (https://) pull data from SQL to create links on the page that the user can click on to get documents to pop-up in the browser so they can view/save them.  The page sends the user's ID as a parameter
and the stored proc uses that to return only the documents that user is allowed to see.  Took forever to figure out... looks great... my employer is going to be impressed and save money... yada, yada yada!  Problem is:  If you knew the name
of a directory on the mapped location and knew the filename (somehow), and you had a login that got you to the site, you could successfully put that address in your address bar and the document would come up!  That's a bad thing!  I need to only
let users see documents they have access to.
I have been playing with the app pool settings and advanced settings for the sub-site, but it still lets me pull items that the logged-in user doesn't have permissions on the server to get to.  I haven't been able to prove it, but I suspect that IIS
is sending another login credential to the directory to retrieve the file... something like "admin" or something that can have wider access.
Here is my setup:  I have a directory on another server that is mapped to the Sharepoint Server box.  I have a Virtual Directory that points to that mapped drive.  My Sharepoint Page is on a site of its own and is called with the URL "https://reportcenter.<company
name>.com".  There is only one page on the site.  When the page opens it provides links to documents on the Virtual Directory.  When you click on any of them the files appear in the browser just fine.  Sharepoint is running on a
Windows 2012 R2 Standard OS.  The test user I am using is "Client1" and they are a member of the "SP_Clients" group which is not a member of anything else in Active Directory.  In the file directory I went to the Share list and
made sure my test user and the SP_Clients group is not in the list... if the system tried to use Client1 there is no way they should get access.
Any thoughts on what I can do to stop Clients from getting to files they shouldn't be?

Answer 1

Thank you for your question and reply.
No, the identity is not passed as a URL property.  The way it works is that SP verifies the user and sends them to the default page after they sign-in.  Once there, the page evaluates the UserID value and that values is passed to a stored procedure
as a parameter.  The user can't get to the page unless they are verified by SP, they can't somehow go around this. 
Now, once the page loads they click on one of files they wish to see (a link on the page that was created from the results of the stored procedure call).  The link points to a virtual directory setup in IIS that points to a mapped drive where the files
are located.  The security on the files is set on the directories in their actual location.  I just need SP to pass the user's ID to the file directory and check the sharing rights on the file to see if this user has rights to get it.  It seems
like SP is passing some other credential (probably SP_Admin, or Admin or something) which has the ability to read the file and therefore pass it back to the screen.
I can't put the documents in SharePoint... they have to be in a file directory. The reason is that we have an elaborate program that runs every month to create these files and places them in the correct directories.  Somehow changing that application
to create the files and place them programmatically in a SharePoint directory is beyond the scope of the project.  Under the circumstances, it would be much simpler to just provide the user a list of the documents they have access to and have them click
on a link on a page and have the document appear in their browser.  Everything actually works, but I just have this last piece where SP is not 'telling' the file directory the UserID of the logged in user and therefore all the documents are available.
All that needs to be done, is to make sure the userID is passed to the file directory so it can be checked against the security there to see if the user can have the file or not.
I hope that makes sense.  I look forward to hearing back from you with your thoughts on this and how this can be accomplished.
Thanks,
Scott