downloading file - flask

about.txt

Okay so here's the setup:

[-] The primary server API is exposed via Flask (Python) and all static files, including all html, css, js is served by nginx. 
[-] Python is exposing an API at url http://domain.com/api/download/<file_id>, where file_id is a database id for the file that we're interested in downloading. 

1. User wants to download a file, so we spawn a new window with the url '/api/download/<file_id>'
2. Nginx intercepts the request, sees that it starts with /api/, and then forwards the request to Flask, which is being served on port 5000. 
3. Flask routes the request to its download method, retrieves the pertinent data from the file_id, and constructs additional header settings to make nginx happy and to force the browser to see the file stream as a download request instead of the browser just trying to open the file in a new window. Flask then returns the modified header stream to nginx
4. Nginx is finally ready to do some work. While parsing the headers for the incoming request, it encounters "X-Accel-Redirect", which instructs nginx to serve the file specified
5. The browser should spawn a download dialog box, but instead it just spawns a new window that contains, as text, the binary contents of the file...

api.py

def get_file_params(filename):
    filepath = os.path.abspath(current_app.root_path)+"/../download/"+filename
    if os.path.isfile(filepath):
        return filename,"/download/"+filename,os.path.getsize(filepath)
    with open(filepath, 'w') as outfile:
        data = load_from_mongo("ddcss","queries",\
            criteria = {"_id" : ObjectId(filename)}, projection = {'_id': 0})
        #outfile.write(json.dumps(data[0], default=json_util.default))
        outfile.write(dumps(data[0]))
    return filename, "/download/"+filename, os.path.getsize(filepath)

app.js

$('#download').click(function(e) {
	
	var file_id = app.file_id;
	if (file_id === undefined) {
		return;
	}
	
	window.open('/api/download/' + file_id, 'Download');
}

nginx.conf

# http://wiki.nginx.org/NginxXSendfile
location /download {
	internal; 
	root /mnt/storage/;
}

location / {
	proxy_set_header X-Sendfile-Type X-Accel-Redirect;
	proxy_set_header X-Accel-Mapping /mnt/storage/=/download/;
}

# this is for Flask
location /api/ {
	proxy_pass http://localhost:5000/;
}

server.py

from flask import make_response
from server.database.api import get_file_params

@app.route('/api/download/<file_id>')
def download(file_id):
	(file_basename, server_path, file_size) = get_file_params(file_id)
	response = make_response()
	response.headers['Content-Description'] = 'File Transfer'
	response.headers['Cache-Control'] = 'no-cache'
	response.headers['Content-Type'] = 'application/octet-stream'
	response.headers['Content-Disposition'] = 'attachment; filename=%s' % file_basename
	response.headers['Content-Length'] = file_size
	response.headers['X-Accel-Redirect'] = server_path # nginx: http://wiki.nginx.org/NginxXSendfile
	
	return response