def protected_file(request, file_path, redirect_root="", 
                   require_login=False, perm=None):
    if perm and request.user.has_perm(perm):
        response = HttpResponse()
        url = '%s/%s' % (redirect_root, file_path)
        
        # Nginx only
        # let nginx determine the correct content type 
        response['Content-Type']=""
        response['X-Accel-Redirect'] = url
        return response
    
    if require_login and not request.user.is_authenticated():
        login_redirect = '%s?next=%s' % (settings.LOGIN_URL, request.path)
        return HttpResponseRedirect(login_redirect)
    return HttpResponseForbidden()
Checks permissions and returns an HttpResponse with the path to the file
dataset/ETHPy150Open lincolnloop/django-protected-files/protected_files/views.py/protected_file