Return to Answer

As @Clive and @prkos mentioned in comments above, Drupal has different stream wrappers for public and private file systems:

https://www.drupal.org/node/15368

https://www.drupal.org/docs/8/core/modules/file/overview#s-managing-file-locations-and-access

If you have configured the private stream wrapper correctly, you can prevent anonymous users from downloading those files and instead respond to their attempts with an HTTP error 403.

The remaining desired functionality is provided by the community-contributed module that @Clive mentioned:

https://www.drupal.org/project/r4032login

The module is available for Drupal 7, 8, and 9. Its project page will explain its usage, but basically it redirects users to the login page when they ask to access a restricted resource, and redirects them to their intended destination once they log in successfully.

As @Clive and @prkos mentioned in comments above, Drupal has different stream wrappers for public and private file systems:

https://www.drupal.org/node/15368

I know you are using Drupal 7, but the Drupal 8 docs on the topic mention:

In Drupal 8, you can no longer set private file system via UI. You set it in your settings.php file.

So you might find it convenient that you can configure this in the Drupal 7 admin UI ( "Private file system path" under admin/config/media/file-system) without any edits to your site's codebase.

If you have configured the private stream wrapper correctly, you can prevent anonymous users from downloading those files and instead respond to their attempts with an HTTP error 403.

The remaining desired functionality is provided by the community-contributed module that @Clive mentioned:

https://www.drupal.org/project/r4032login

The module is available for Drupal 7, 8, and 9. Its project page will explain its usage, but basically it redirects users to the login page when they ask to access a restricted resource, and redirects them to their intended destination once they log in successfully.

As @Clive and @prkos mentioned in comments above, Drupal has different stream wrappers for public and private file systems:

https://www.drupal.org/node/15368

https://www.drupal.org/docs/8/core/modules/file/overview#s-managing-file-locations-and-access

Like many things on "Drupal Island" the best practice for setting up the private files has been a somewhat controversial subject:

https://www.drupal.org/project/documentation/issues/1006692

Here's a related Drupal StackExchange answer that describes an approach for Drupal 7:

https://drupal.stackexchange.com/a/197645/80164

If you have configured the private stream wrapper correctly, you can prevent anonymous users from downloading those files and instead respond to their attempts with an HTTP error 403.

The remaining desired functionality is provided by the community-contributed module that @Clive mentioned:

https://www.drupal.org/project/r4032login

The module is available for Drupal 7, 8, and 9. Its project page will explain its usage, but basically it redirects users to the login page when they ask to access a restricted resource, and redirects them to their intended destination once they log in successfully.

As @Clive and @prkos mentioned in comments above, Drupal has different stream wrappers for public and private file systems:

https://www.drupal.org/node/15368

https://www.drupal.org/docs/8/core/modules/file/overview#s-managing-file-locations-and-access

If you have configured the private stream wrapper correctly, you can prevent anonymous users from downloading those files and instead respond to their attempts with an HTTP error 403.

The remaining desired functionality is provided by the community-contributed module that @Clive mentioned:

https://www.drupal.org/project/r4032login

The module is available for Drupal 7, 8, and 9. Its project page will explain its usage, but basically it redirects users to the login page when they ask to access a restricted resource, and redirects them to their intended destination once they log in successfully.

As @Clive and @prkos mentioned in comments above, Drupal has different stream wrappers for public and private file systems:  https://www.drupal.org/node/15368  https://www.drupal.org/docs/8/core/modules/file/overview#s-managing-file-locations-and-access

Like many things on "Drupal Island" the best practice for setting up the private files has been a somewhat controversial subject:  https://www.drupal.org/project/documentation/issues/1006692

Here's a related Drupal StackExchange answer that describes an approach for Drupal 7:  https://drupal.stackexchange.com/a/197645/80164

If you have configured the private stream wrapper correctly, you can prevent anonymous users from downloading those files and instead respond to their attempts with an HTTP error 403.

The remaining desired functionality is provided by the community-contributed module that @Clive mentioned:

https://www.drupal.org/project/r4032login

The module is available for Drupal 7, 8, and 9. Its project page will explain its usage, but basically it redirects users to the login page when they ask to access a restricted resource, and redirects them to their intended destination once they log in successfully.

As @Clive and @prkos mentioned in comments above, Drupal has different stream wrappers for public and private file systems: 

https://www.drupal.org/node/15368 

https://www.drupal.org/docs/8/core/modules/file/overview#s-managing-file-locations-and-access

Like many things on "Drupal Island" the best practice for setting up the private files has been a somewhat controversial subject: 

https://www.drupal.org/project/documentation/issues/1006692

Here's a related Drupal StackExchange answer that describes an approach for Drupal 7: 

https://drupal.stackexchange.com/a/197645/80164

If you have configured the private stream wrapper correctly, you can prevent anonymous users from downloading those files and instead respond to their attempts with an HTTP error 403.

The remaining desired functionality is provided by the community-contributed module that @Clive mentioned:

https://www.drupal.org/project/r4032login

The module is available for Drupal 7, 8, and 9. Its project page will explain its usage, but basically it redirects users to the login page when they ask to access a restricted resource, and redirects them to their intended destination once they log in successfully.