title: How can I secure an icalendar (.ics) subscription?
body: <p>I have a multi-user website and want to publish an individual icalendar subscription file (.ics) for each user.</p>
  
  <p>Our apache server is configured to only provide access over https.</p>
  
  <p>One method I have considered is, when the user first asks for their subscription URL, generate a long, random secret key and include that in the URL. A hash of that key would then be stored in the database. Example: <a href="https://site.com/calendar/user_id/dQXeCgtiOmZ5lAXoedmujiuA47VmCgA5OIfE6vZ8BhJT3Rxh20b9Ci.ics" rel="noreferrer">https://site.com/calendar/user_id/dQXeCgtiOmZ5lAXoedmujiuA47VmCgA5OIfE6vZ8BhJT3Rxh20b9Ci.ics</a></p>
  
  <p>All pages in our cakephp app require the user to be logged in (expect the login page obviously). I would configure the ics file to also not require the user to be logged in, but to only display when the correct secret key (tested against the hash) was supplied.</p>
  
  <p>Are there any drawbacks to this method?</p>
  
  <p>Is there a different method that I should be using?</p>
  
  <p>I have seen examples of people including basic authentication in the subscription URL, but that sounds like it would be worse. Example: <a href="https://user%3apassword@site.com/calendar/user_id" rel="noreferrer">https://user:password@site.com/calendar/user_id</a></p>
  
  <p>This is being deployed in a school environment, so the iCalendar subscriptions contain fairly mundane things such as class timetables and assignment due dates, but I still want to keep it secure.</p>