Serving uploaded (and other) files using Django

Throughout this chapter and Chapter 5, Serving Static Files, we have discouraged serving files using Django. This is because it would needlessly tie up a Python process just serving a file – something that the webserver is capable of handling. Unfortunately, web servers do not usually provide dynamic access control, that is, allowing only authenticated users to download a file. Depending on your web server used in production, you might be able to have it authenticate against Django and then serve the file itself; however, the specific configuration of specific web servers is outside the scope of this book.

One approach you can take is to specify a subdirectory of your MEDIA_ROOT directory and have your web server prevent access to just this specific folder. Any protected media should be stored inside it. If you do this, only Django will be able to read the files inside. For example, your web server could serve everything in...