heroku - Rails Paperclip S3 hide url of attached file -

i using paperclip upload files directly aws s3 (following guide: https://devcenter.heroku.com/articles/paperclip-s3).

as shown below, user can view file in browser using "attachment.file.url" method. security vulnerability display s3 url user? if so, there way hide url without streaming file app first or "download_file" controller action?

production.rb

rails.application.configure   config.paperclip_defaults = {     storage: :s3,     s3_credentials: {       bucket: env.fetch('s3_bucket_name'),       access_key_id: env.fetch('aws_access_key_id'),       secret_access_key: env.fetch('aws_secret_access_key'),       s3_region: env.fetch('aws_region'),     }   } end 

attachment.rb

class attachment < activerecord::base   belongs_to :upload, polymorphic: true    has_attached_file :file   validates_attachment :file, content_type: { content_type: ["image/jpeg", "image/gif", "image/png", "application/pdf", "application/vnd.ms-excel",                   "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",              "application/msword",               "application/vnd.openxmlformats-officedocument.wordprocessingml.document",               "text/plain"] } end 

view

<h5>file uploads</h5>   <ul>     <% @attachments.each |attachment| %>       <li>         <%= link_to attachment.file_file_name, attachment.file.url, :target => '_blank' %>        </li>     <% end %>   </ul>   <%= link_to "add files", new_attachment_path(:upload_type => 'team'), class: "btn btn-md" %> 

the s3 url visible can use dev tools anyway exposing not security vulnerability. argue bad ux discussion time.