Custom authentication?

[Oliver Beattie <oliver@xxxxxxxxxxxx>]

Hi there,

I am sure this question has likely been asked many times before, I'm just having a bit of a hard time finding answers.

Basically, I need to be able to authenticate downloads based on a URL signature if present (passed as a query parameter), instead of via Basic authentication (I need to support both of these, but bypass the basic auth if no signature is present). It isn't a requirement that they live at the same path, so they can be at different virtual hosts/directories if necessary. 

At first, I thought the best way to do this would be just through a simple CGI/WSGI/whatever, but the files I am authenticating access to are very large (many GB) and I fear there may be a performance implication of doing this (and things like Range requests won't be possible without extra work).

Has anyone had any experience with this? What is the best way to proceed? Any help anyone could give would be very much appreciated :)

—Oliver