You encode the expiration date into the URL and then add a cryptographic signature (by computing something like the SHA1 of the data in the URL plus some string that you keep secret).