def remote_static():
    """Stream *large* static files with special requirements."""
    file_path = request.args.get("file") or "."

    # Check that user is logged in or that file extension is valid
    if current_user.is_authenticated is False or file_path not in session.get("igv_tracks", []):
        LOG.warning(f"{file_path} not in {session.get('igv_tracks', [])}")
        return abort(403)

    range_header = request.headers.get("Range", None)
    if not range_header and (file_path.endswith(".bam") or file_path.endswith(".cram")):
        return abort(500)

    new_resp = send_file_partial(file_path)
    return new_resp
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.