I'm developing a web application which stores sensitive information, which the user can access after a check that I built. This function then returns a download url to the user which leads to the FTP Server.
My concern is that it might be vulnerable to exploitation, people could alter certain url's to download files from the FTP Server. For example changing:
Is this possible to be exploited and if so, is there a better way to make sure this can't be abused?