I use Flask in backend and React in frontend. Users are not required to log in. In the frontend after processing the user's request I present text with links to several pdf documents. Currently, the documents reside in a public folder on the backend server, and the user access them simply by clicking the link and a new tab opens in the browser showing the pdf. But, I want to semi-lockdown the folder, so that the documents are only accessible by the user using the app, and that the user can only see the documents relevant for her request.
I have read a lot of similar questions but none of the solutions have worked for me so far.
I have tried to have the various links call a route in the backend and the backend can then send the file to the frontend. I used send_file and send_from_directory for that, but always get a file with 'null' in it.
My code in the backend for this function is:
def function_to_get_file(): try: return send_from_directory(, , as_attachment=True)
except Exception as e:
return str(e)
I have tried various combinations of as_attachement and mimetype.
I am testing with Postman and with a direct request in a browser to localhost:5000/function_to_get_file. Both simply return 'null'. I have verified the and at runtime.
Any help is highly appreciated. And if you think I should follow a different design altogether, then please advise.