I have a script I'm working with that presents to the user a page that requests a password before viewing a directory. Then they get the list of files within that directory (without opening the directory itself). The problem is that it's security-through-obscurity - after the first time they log in and click on a file link, then they know the file path and can access it (as well as others) again without logging in.
Is there any way for my cgi script to present to the logged in visitor the file, without any way to track back to the file? That way I can make the directory non-public.