Original code here: https://giacomodeliberali.com/blog/umbraco-protect-media-items
This is the result of me modifying things and trying to get it working in Umbraco 9 cloud.

One major difference: I decided to redirect all ~/media folder requests to /secure, and handle it there.
This is because I had trouble hijacking /media in umbraco cloud, probably due to my own ignorance.