Plug.Static does mostly three things:
- Locating the requested file in the filesystem
- Handling content type, range and other headers
- Calling Plug.Conn.send_file/3,4,5 to efficiently stream the data from the filesystem to the socket
So if you want to handle step 1 yourself (with added authentication and authorization) you can just write a controller that handles the necessary headers and uses send_file to have similar performance/efficiency as Plug.Static
Edit: it won’t be quite as efficient, presumably, as Plug.Static is usually called early in the Endpoint, while controller action pass through all the Endpoint and Router plugs; but you need many of those anyway if you’re going to do session-based auth
