• Maintain a directory called /sessions somewhere on your web server.
• Whenever a user logs in, create an empty text file with the session ID in /sessions. E.g. 123456
• In your PHP app, serve out images like this: /sessions/123456/images/test.jpg
• In your htaccess file, have two redirect commands.
• One that translates /sessions/123456/images/test.jpg into /sessions/123456?filename=images/test.jpg
• A second one that catches any calls to //sessions/(.*) and checks whether the specified file exists using the -f flag. If /sessions/123456 doesn't exist, it means the user has logged out or their session has expired. In that case, Apache sends a 403 or redirects to an error page - the resource is no longer available.

• Expired session files would have to be deleted quickly using a cron job, unless it's possible to check for a file's mtime in .htaccess (which may well be possible).
• The image / resource is available to any client as long as the session exists, so no 100% protection. You could maybe work around this by adding the client IP into the equation (= the file name you create) and do an additional check for %{REMOTE_ADDR}. This is advanced .htaccess mastery but I'm quite sure it's doable.
• Resource URLs are not static, and have to be retrieved every time on log-in, so no caching.

$filename = $_GET['filename'];

// Modify this line to indicate the location of the files you want people to be able to download
// This path must not contain a trailing slash.  ie.  /temp/files/download
$download_path = "ficheros/";
	
// Make sure we can't download files above the current directory location.
if(eregi("\.\.", $filename)) die("I'm sorry, you may not download that file.");
$file = str_replace("..", "", $filename);
	
// Make sure we can't download .ht control files.
if(eregi("\.ht.+", $filename)) die("I'm sorry, you may not download that file.");
	
// Combine the download path and the filename to create the full path to the file.
$file = "$download_path$file";
	
// Test to ensure that the file exists.
if(!file_exists($file)) die("I'm sorry, the file doesn't seem to exist.");
	
// Extract the type of file which will be sent to the browser as a header
$type = filetype($file);

// Get a date and timestamp
$today = date("F j, Y, g:i a");
$time = time();

// Send file headers
header("Content-type: $type");
header("Content-Disposition: attachment;filename=$filename");
header("Content-Transfer-Encoding: binary");
header('Pragma: no-cache');
header('Expires: 0');
// Send the file contents.
set_time_limit(0);
readfile($file);