We have a mobile app developed using Angular 7 & Ionic 4. A while back we conducted a penetration test and, in order to be compliant, we changed the way files are transferred in the app. Instead of getting the file url directly through API, we receive an url of which the content type is application/octet-stream, and we use the following method to download the file and save it in device storage: