>
>So I want to create the link to the document from the web service as the user has already been authenticated. I need to include a username / password to gain access to the PDF directory. I can do that either as a URL argument or as hidden variables in the HTML document.

(I'm assuming you're using ASP.NET - if not, the idea is the same but the code would be different)

We do something like this on our website. We have documents that some users have access to and some don't. I store all of the documents in a common directly and use a GUID for their name. I create a record in a table w/the GUID and the original filename. All links to the documents go through a ASHX handler. The users don't have direct access to the folder where the docs are stored. The handler receives the request, ex.

http://www.mysamplesite.com/MyHandler.ashx?file=882adbdd-12b0-4889-9b3a-b1e1643de32e.pdf

It checks to see if the currently authenticated user has access and if so it returns the file. I actually look up the original filename and pass that in the header so they get a nicer filename instead of a GUID.

// Code above here resolves fullPathFilename and populates an object with the original filename
System.IO.FileInfo fileToDownload = new System.IO.FileInfo(fullPath);

context.Response.AddHeader("Content-Length", fileToDownload.Length.ToString());
context.Response.AddHeader("Content-disposition",
                                       string.Format("attachment;filename={0}", content.Entity.OriginalFilename));
context.Response.TransmitFile(fullPathFilename);
context.Response.End();

>A) Is their a way to hide the URL - or arguments - so that it is not viewable or recoverable by a user?

Not that I know of.

>B) Is their a utility to encrypt HTML files so that it will still be viewable from the myriad of browsers available? This should be able to be executed from within the web service as the web service builds the HTML pages.
>

Same answer.