0

I have an API controller (.NET Framework 4.8 and IIS server) that returns a file or 404 if the file is not found. I added some custom headers to the response just to specify what was the problem (I'm than using this information on FE app to show some specifying messages to user).

However, when I call the API, I don't get the custom headers when returning 404. I tried changing the status code to 200, 204 and it works.

The controller method looks like this:

[HttpPost]
public ActionResult FileDownload(DataModel data)
{
    try
    {
        return DownloadFile(data);
    }
    catch
    {
    }

    Response.Headers.Add("x-custom-header", "custom header content");

    return new HttpStatusCodeResult(404);
}

The FE method for fetching the file:

    fetch(props.href)
        .then((response) => {
            let customHeader= response.headers.get("x-custom-header");
                    console.log(customHeader);

            if (response.status !== 200) {
                throw response.status;
            }

            return response.blob();
        })
        .then((blob: Blob) => {
            let fileUrl: string = window.URL.createObjectURL(blob);
            let a: HTMLAnchorElement = document.createElement("a");
            a.href = fileUrl;
            a.download = fileName;
            document.body.appendChild(a);
            a.click();
            document.body.removeChild(a);
            setLinkText(linkTextSuccess);
        })
        .catch((error) => {
            console.log(error);
            setLinkText(linkTextError);
        });

Why is it that with 404 status code, the headers are not sent? Could I somehow enforce that?

Thank you for your time!

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
  • Does this answer your question? [In the HTTP CORS spec, what's the difference between Allow-Headers and Expose-Headers?](https://stackoverflow.com/questions/28107459/in-the-http-cors-spec-whats-the-difference-between-allow-headers-and-expose-he) – Lex Li Aug 10 '22 at 15:07
  • Please understand that your web API clearly sent the header, but modern web apps must properly configure CORS so as to allow custom headers to pass through to browser sandboxed apps (your FE). This has been discussed for years, so you have tons of existing threads to learn from. – Lex Li Aug 10 '22 at 15:08

0 Answers0