A UUID in the URL is not a lock. Check the session on the GET that returns the bytes, record who owns the file, and keep shared caches from storing it.

A step by step guide to add cookie based login to a SvelteKit app using hooks.server.ts, form actions and an HttpOnly session cookie.

In this tutorial you will learn how to handle client side auth routes in SPA mode with the correct security assumptions.