How do I force a download with App Bridge?

[PhobosTech]

First - I apologize, I have another post with a similar question, but I don't think I really spelled it out. And, being that you can't exactly delete old posts, I'm just going to clarify & hopefully I can catch an answer or two.

At first glance, this seems like an easy fix - just churn out an anchor tag with the download attribute linking to a previously written file. However, that carries with it some serious security issues.

The best option is to build the file out, stick it in memory or some other temp buffer, and force the download by manipulating headers. That's what one would *usually* do.

The problem is: when you're running through the App Bridge, Shopify is intercepting and modifying all sorts of header data and variables. I have tried every possible conceivable way. I've even hacked up a few fairly creative, mildly genius (if I don't say so myself) methods I was almost positive could skirt around the problem - alas, to no avail.

This is actually a pretty big problem for me and my client. Would anybody happen to know the secret to forcing downloads when you're running from the App Bridge?

Please somebody know ... please please please 🙂

Thanks in advance to anybody who could shed some light on this ... "feature" 😉

[Henry_Tao · Accepted solution]

Hi @PhobosTech ,

Regarding to downloading a file, I would be interested in learning all of your exploration in details. There is a way that I think it would work is that you build the download url and use App Bridge Remote Redirect with newContext so that it will open your download link as new tab https://help.shopify.com/en/api/embedded-apps/app-bridge/actions/navigation/redirect#redirect-to-an-.... Regarding security concern, you can add an one time use key to the query param so that the link can be only used once. 

May I know what file format you want to download? 

Thanks, 

Henry

[PhobosTech]

Ah, ok. Thank you for the info.

Yes, the file type is csv. I'm building it out on the fly according to the merchant's request.

[Henry_Tao]

Let us know if the remote redirect approach works for you on all desktop, android, and iOS.

[CharlyTalavera]

I tried this and it works before. But it looks like this solution is not longer valid. It's not downloading the files inside Shopify app anymore.

Do you have any solution or workaround for it?

[Freddy_dev]

Remember to skip before action for the download method. As suggested by @Henry_Tao , add an one time use custom key to the query param so that the link can be only used once. 

[PhobosTech]

So, I've obviously tried the usual:

$fullCSV = "inc/temp_csv/generatedCSVs/{$csvFile}.csv";

$readableStream = fopen($fullCSV, 'rb');
$writableStream = fopen('php://output', 'wb');

header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header("Content-Disposition: attachment; filename=\"".basename($fullCSV)."\"");
header('Expires: 0');
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Pragma: public");
header('Content-Length: '.filesize($fullCSV));
flush();
readfile($fullCSV);

stream_copy_to_stream($readableStream, $writableStream);

 Then when I realized what was actually happening here, I tried redirecting with header('Location: csvdownload.php') and forcing a download after a redirect to avoid any output or header changes were happening sometime after the initial buffer output; but, that didn't work. I'm guessing the way Shopify's App Bridge works is a bit different from how I previously had imagined.