调用API url参数问题

Question

I have a cms, where am using laravel as web api, angularjs for requests. I have an iframe where I call to services with a direct link and put it usig trusted src function.

The main problem is, I can not use a normal http post request and hide parameters, because using http request will return data, not file, and the report api returns in headers, an html file, pdf ... etc) so when i get result to the success of my http request, it won't download pdf file, it will show special chars

in the i frame am calling the api like this : "localhost/api/getreportService/"+$scope.brandid+"&"+$scope.customerid"

but that's cannot be secure, is there any way to hide the request here from users?

Answer 1

ok, I found a solution, I called the api via http post request then I used $sce tustAsHtml for the response, with a ng-bind-html in my template and the result is good now, the report is showing in the div,

Now all is safe, the user needs a token to access the report, and that's impossible without a login.