Is there a better way to authenticate users and secure the website?

Hi,

I have a secure download site and people can't browse it on the browser if they go to our main download site directory, it will show on the page "the website declined to show this webpage" and this is what we want it. I have a client who has a program that could send the request string to our download site (download handler) through the http query string with username, password and filename that they want to download from our web site.  After the download handler validates a username and password, then it will give them the file's link to download a file.  So I'm wondering how secure is that to give out the file for them on the web page? does it exposes the file to other people if they get the download link file? Because this is a personal report and they don't want to expose to other people.  Does anyone knows this is a secure way to do it? If not, is there a better way to authenticate users and secure a ...