In my content management system (CMS), I am utilizing Laravel as a web API and AngularJS for making requests. An iframe is being used to call services with a direct link using the trusted src function.
The issue I'm facing is that I cannot employ a standard HTTP POST request to hide parameters, as this type of request returns data rather than a file. The report API typically returns an HTML file or PDF in the headers. Consequently, upon receiving the result from my HTTP request's success callback, the PDF file does not download properly and displays special characters instead.
Within the iframe, the API is called as follows: "localhost/api/getreportService/"+$scope.brandid+"&"+$scope.customerid"
However, this approach is not secure. Is there a method to conceal the request from users?