Reviewing the file download controller in spring rest
In my opinion, there are two ways with Spring to do that; your way is one of them (using the Spring Resource), and the other is to inject the file bytes directly in the javax.servlet.http.HttpServletResponse.
Your version can be improved, since you can use the FileSystemResource instead of the InputStreamResource.
The InputStreamResource is good when there are no other options available, as stated in the Java documentation since there are lots of other implementations to use.
Should only be used if no specific Resource implementation is applicable[...]

The FileSystemResource will remove the need to open the file and make the code shorter.
HttpHeaders header = new HttpHeaders();
header.add(HttpHeaders.CONTENT_DISPOSITION, &quot;attachment; filename=&quot; + filename + EXTENSION);
header.add(&quot;Cache-Control&quot;, &quot;no-cache, no-store, must-revalidate&quot;);
header.add(&quot;Pragma&quot;, &quot;no-cache&quot;);
header.add(&quot;Expires&quot;, &quot;0&quot;);

File file = new File(serverLocation + File.separator + filename + EXTENSION);
Resource resource = new FileSystemResource(file);

return ResponseEntity.ok()
.headers(header)
.contentLength(file.length())
.contentType(MediaType.parseMediaType(&quot;application/octet-stream&quot;))
.body(resource);


The thing that concerns me with your code, is the potential Path Traversal vulnerability that you have when reading the file, from the parameter. If I pass the filename value of ..\..\..\system.log, this could potentially be a problem, because we could download file out of the scope of your application.
File file = new File(serverLocation + File.separator + filename + EXTENSION);

One way to prevent that is to compare the base path / location of the file with the serverLocation, if the path is different, you ignore the request.