In my view, if your web server responds to an arbitrary HTTP GET with the asset and 200 error code, then your intention is that the asset is public and any browser can request it. If you don’t like a particular request, return 403 and get on with your life.