You can make a request like https://www.mysite.com/app?fileid=1 with the prementioned headers. On server side validate credentials and identify the file by the fileid (or whatever you use). Set the response type to application/content-stream read the file and write its bytes to the response.