Manage access to static (not only download)

help
1

yo guys, I’m searching for solution of my problem, mby some one has any clues about it. I need to show files preview (.pdf) to a users, who have access to that. One guy gave me advice to use Picker for server side routing, so i’m using that for:

Picker.route('/preview/:_id', function(params, req, res, next) {
  console.log(params._id);
  // res.setHeader('Content-Type', 'application/pdf');
  // res.setHeader('Content-Disposition', 'inline');
  res.setHeader('Content-Disposition', 'attachment; filename=designGuide.pdf');
  res.setHeader('X-Accel-Redirect', 'http://localhost:8080/internal/designGuide.pdf');
  res.end('');
});

as u can see, i’m redirecting to nginx and it works, but the problem with that, that the browser starting download instead showing .pdf file. Any suggests? PS: content-disposition: inline - not helps…
why im using x-access-redirect? Cause just imaging, if i’ll send a file to a user with acces, he cans just copy source link to a file and send it to another user, without access - unacceptable.