Uploaded Private files access problems On my Drupal 7 install, I have content type in which user can upload files to the server, via file upload field. I was sure everything was fine, I forgot about the system (was sure it was working, tested it). But strange enough, after some time I tested it, I could not download files, not by clicking on file link on that content type, nor by pasting url of the file in adress bar.

When I tried to access files, I got HTTP request status: 403 (Forbidden in http headers, while browser shows login page and path in the adress bar was path of that file...

And strange enough, under /admin/config/media/file-system I defined private files path to be files/private, and files were uploaded to that directory. But on the content type page - link to file ignored files/private path and rather had path system/files that I have not defined anywhere!

To test things, I migrated user private files to system/files (actually created that folder and subfolder in drupal root) and defined path of the private files to be also system/files (on /admin/config/media/file-system ). 

Got some "progress" -  Apache "Forbidden" page - when acessing private files. There was .htaccess file in the folder, with config

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Deny from all
Options None
Options +FollowSymLinks


And for test,  I renamed that file to bypass "Deny", and voila, I could access my newly uploaded files.
But previously uploaded files still throws mysterious HTTP request status: 403 (Forbidden in  http headers, while browser showed login page and path in the adress bar was path of that file...

I was using Public local files served by the webserver. under /admin/config/media/file-system. I noticed also, when I enter that config, if I am missing .htaccess file in private files dir, a new one is being created.

I have to mention that I implemented Varnish cache and APC in Drupal, but things are not better after clearing the cache.

Could someone please tell me what is happening and how I can set it to work correctly/securely? Thanks!
Although and older issue, it's worth noting that system/files is normal for Drupal private file mode paths.

That is because system/files is the logical application path that handles and routes to the file on the actual file system.

It is this logical path that allows the additional authentication checks that private file mode allows.

You can put your private files under sites/default/files/private and Drupal will automatically create an .htaccess file to deny direct web access to them.

However, for safety, it's recommended to put your private files directory outside the html web root. For example, one level up from your website document root, or some other designated folder.

If curious private files are served via system_menu which defines the system/files url callback to file_download.

Following that hook_file_download is used to provide access control to the requested private file.