Okay, so no basename here.
You can however have several paths in your nginx settings, e.g.

path1: /protected/
path2: /public/
path3: /usercontent/

use default: path1

and filename, e.g.
1) /public/file.tar <- use path2, valid
2) file.tar <- use path1 by default (no "/" as first char of string), valid
3) some/file.tar <- path1 by default (no "/" as first char of string), use subdirectory, too, valid
4) /some/invalid/file <- invalid root path used, invalid, exception

As we can't know what nginx maps for the path, we can not do any file_exists checks on them, and that's okay.