But couldn't a better checkpoint be designed with some overhead?

Say all urls containing /static/.. don't refer to an actual physical resource but go to a controller which checks the access and then serves the file. As such, the URL if given to someone else will fail as the controller won't authorize the file transfer.

I did it once with nginx at the front and django at the backend using X-Sendfile. I don't have the code around but it was similar to what is proposed in this discussion: http://groups.google.com/group/django-users/browse_thread/th...

Of course, this can't be done for the CDNs.

When you say it's a common industry practice, is the practice there because of CDNs?