Following example demonstrates how to:
- display a private file download prompt to the user (here for a PDF file)
- serve a private image or PDF which will be displayed on a webpage
See https://symfony.com/doc/4.4/components/http_foundation.html#serving-files
Host these files in a directory outside of /public, so they can be accessed only through the controller and its @Security() authorization. For example you could create a /private-uploads directory at the root of your project.