I have a PDF that is put up by a controller I wrote (it puts the pdf right on the response stream, and I set the content-type as pdf).
I also specify that this is an attachment, so I am presuming that it won't open the PDF in a new window - the controller is called by a url that is in an IFRAME. Works just fine, with the anonymous bypass, as long as I open the browser window from the same machine that Tomcat is running on. If I use the app remotely, it doesn't work at all. I get the login page inside the IFRAME. Also, instead of opening in the IFRAME, it opens in a new window, which isn't what I'm trying to do. Any ideas? String originalFileName = request.getParameter("fileName"); *logger*.debug("File name " + originalFileName); response.setContentType( "application/pdf" ); response.setHeader("Content-disposition", "attachment; filename=" + originalFileName); String path = request.getSession().getServletContext().getRealPath("/"); *logger*.debug("Real path is: "+ path); String fullPathName=path+"documents\\"; String fileName = fullPathName + originalFileName; FileInputStream in = *new* FileInputStream(fileName); *int* length = in.available(); *byte*[] pdfbytes = *new* *byte*[length]; in.read(pdfbytes); in.close(); // Send response response.setContentLength(pdfbytes.length); ServletOutputStream outputStream = response.getOutputStream(); outputStream.write(pdfbytes, 0, pdfbytes.length); outputStream.flush(); outputStream.close();