You should look into x-file-redirect. That way you can have a backend script handle the authentication and then let Nginx handle the streaming part if the user is allowed to download . Posted at Nginx Forum: http://forum.nginx.org/read.php?2,119550,120491#msg-120491