def opds_download_link(book_id, book_format):
    # I gave up with this: With enabled ldap login, the user doesn't get logged in, therefore it's always guest
    # workaround, loading the user from the request and checking it's download rights here
    # in case of anonymous browsing user is None
    user = load_user_from_request(request) or current_user
    if not user.role_download():
        return abort(403)
    if "Kobo" in request.headers.get('User-Agent'):
        client = "kobo"
    else:
        client = ""
    return get_download_link(book_id, book_format.lower(), client)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.