Problem with restricted download links (hook_file_download)
Having read about the performance implications of using private file system, I decided I cannot afford it so I thought I'd write a small module to control the download.


The performance hit from using the private file system is minimal.

IMHO, using the private file system to control download access to files is the only sane way to do this when using Drupal.


  What am I doing wrong?


You err in not using the private file system .

When you hand the direct link to the browser, it goes directly to that link.  It does not even see the PHP/JavaScript you've put in place to restrict download access.

To prevent unauthorised downloads, you must enforce that the downloads are managed by Drupal, and that this access control cannot be bypassed by requesting direct links served by the browser. This is what the private file system (aka private download method) does.

This download method stores the files attached to a node in a directory that is not accessible by the browser (preferably above the web-root). The only way to get to these files, are then through Drupal.