Throw-away URLs perhaps?

[orkysoft]

Give the client a URL with some 'random' element in it, and at the server-side, record this same 'random' element. Once the URL is accessed once, that access is recorded (say, by a CGI script that the URL calls), so future attempts at using that 'random' value won't work anymore.

http://www.somewhere.com/getfile.pl?file=win2k+without+bugs&key=RND#

Getfile.pl must know that number is a valid key, and once it's used, it should be either marked invalid, or just forgotten about.

If you mark it as used, the program can tell the user the key is invalid, and let him contact tech support (connection could have been lost, resulting in an incomplete download), so they can analyze logs, and decide whether to re-enable the key.

Update: tilly prefers pathinfo parameters, because of some bug with Excel not liking ? in URLs. (I don't know why Excel would be involved here, though.)

http://www.somewhere.com/getfile.pl/goodie/41579087

Okay, for completeness, here's what tilly says:

• tilly says It looks like a standard URL poisoning scheme. Be warned that if the download is for Excel, there is a bug if the URL contains a ? in it. So I prefer the pathinfo approach for downloads.
• tilly says If you send a file named foo.csv to a Windows machine which has associated that with Excel (which most have), then it will prompt (at least on IE) for download vs run. The run is broken with IE 4.0 if their temporary internet file...
• tilly says Where was I. Oh right, if the temporary file has a path with a space (eg "Temporary Internet Files" - the default on NT) it will launch Excel multiple times, and none will have the right file. No idea why.

(This is why you should consider the pathinfo approach.)