I faced a similar problem sometime ago. You will not be able to download the file using a GET request using href attribute as u mentioned in the question.
Instead you can submit a form embedded in an iframe as suggested here and submit the form with your file id as a hidden element and it should trigger the download. So your anchor tag shall be:
<a href="javascript:void(0)" onclick="downloadFile('+fileId+')">download</a>
Now pass your fileId as parameter to the onclick JS function and define it like this:
function downloadFile(fileId) {
let $iframe, iframeDoc, iframeHtml;
if(($iframe = $('#download_frame')).length === 0) {
$iframe = $('<iframe id="download_frame" +
' style="display: none;" src="about:blank"></iframe>'
).appendTo('body');
}
iframeDoc= $iframe[0].contentWindow;
if (iframeDoc.document) {
iframeDoc= iframeDoc.document;
}
iframeHtml= '<html><head></head><body><form method="POST" action="http:localhost:8080/MyProject/downloadAction.action"><input type="hidden" name="fileId" value="'+fileId+'"></form></body></html>';
iframeDoc.open();
iframeDoc.write(iframeHtml);
$(iframeDoc).find('form').submit();
}
You can follow similar approach for single or multiple files.
Also to add you can include this in ur web.xml in the filter configuration:
<init-param>
<param-name>cors.allowed.headers</param-name>
<param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,X-Test-Header,Cache-Control
</param-value>
</init-param>
<init-param>
<param-name>cors.exposed.headers</param-name>
<param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials
</param-value>
</init-param>