[eterm]

If it doesn't leave the browser, how would the server know to serve the private content?

[jadengeller]

Client web app makes POST request. It leaves browser, but not in URL

[Gigachad]

That only works if you can run JavaScript. If you want to download a file with curl for example it fails.