Hi Sebastian,

According to the ZAF2 client.request() documention, it seems that setting cors: true in the settings should make the request come from the browser, not the proxy service (which doesn't support binary files) and include the authorization header. I am actually requesting a text file attachment in these cases (application/ics or text/calendar .ics files). However, that seems to just be broken, though, when cors: true is set it is not including the Authorization Header for requests to those URLs, because they are actually redirected URLs. I would suspect this is due to some whitelisting, as the documentation for client.request() states "Requests to Zendesk APIs are always made from the browser, regardless of this option." But the URL I am requesting is a request to a Zendesk.com domain, but that is being redirected to the actual URL, which is causing the CORS issue. Thus, a missing Authorization Header here seems like more of a bug/oversight of the request() method.

The issue is definitely that the Authorization Header is not being sent, and is required when fetching attachments, as per: https://support.zendesk.com/hc/en-us/community/posts/4411831431450-Download-the-Zendesk-ticket-attachment-via-API

So the ZAF2 framework handles the Authorization Header token for me, so I should be able to retrieve it somehow, in order to inject into the headers of a native AJAX call?

If this isn't possible, where do I request this feature? Seems like this should be an easy method to add to the ZAFClient. client.getAuthorizationHeader().

I did find a post with this exact issue, and it is simply that the Authorization Header needs to be supplied, but I don't see how to pull that within a ZAF2 app.

I could setup my own OAUTH2, but that seems silly when the ZAF2 client already has all that. Doing it with a custom OAUTH2 setup would require me to have a separate server to authenticate the OAUTH2 client to, which kind of defeats the purpose of using a ZAF2 app.

As per https://developer.zendesk.com/documentation/ticketing/using-the-zendesk-api/making-cross-origin-browser-side-api-requests/ the ZAF client should be used when you need to transparently handle the OAUTH2 authorization token, but it doesn't support fetching binary files. So I need a method to retrieve the Authorization Header token from the ZAF client somehow, and I don't see how I can do that.

Here's the post speaking about doing this, but the "use OAUTH" solution would only work when the request comes from outside Zendesk ZAF2: https://support.zendesk.com/hc/en-us/community/posts/4411831431450-Download-the-Zendesk-ticket-attachment-via-API