I have a scenario where one app sends a list of links to files, then a web app receives them and displays to the user. The user then can select one of these files, which will then be sent to another app for further processing.

I am considering two approaches for implementing this transfer:

1. Download the file on the web app side, save it in a javascript variable somehow, and then send it to the final app.
2. Pass the file link to the server and let the server download the file itself.

I’m leaning towards the second option but have concerns about its security.

What would be the best practice for this kind of file transfer? Are there specific security implications or performance considerations I should be aware of for either approach?

Any advice or alternative suggestions would be greatly appreciated.

Thank you!