You can use the Turnkey MVC GetImage controller to return a Blob or permitted text attribute for a specific object, including as an image source or a file-download link from MVC or Angular views.
What GetImage returns
GetImage reads an attribute from an object identified in the request and writes its value to the browser response. Although the controller is named GetImage, it can return:
- A Blob attribute, such as an image, PDF, or other stored file.
- A text attribute, when that attribute is explicitly allowed for MVC access.
This is useful when a Angular view or MVC view needs a URL to a stored file but should not load the attribute value into the client ViewModel. For example, use a link to a delayed-fetch Blob attribute rather than binding the Blob itself.
Build the URL
The controller is available under the Turnkey route:
/Turnkey/GetImage?img=<object-identity>-<attribute-name>
The first part is the object identity and the second part is the name of the attribute that holds the Blob or text. For example:
http://localhost:5052/Turnkey/GetImage?img=9!10-SomeImage
In this example, 9!10 identifies the object and SomeImage is the requested attribute.
Set the response content type
Add a third section to send a content-type header to the browser:
/Turnkey/GetImage?img=<object-identity>-<attribute-name>-<content-type>
For a PDF, URL-encode the slash in the content type:
http://localhost:5052/Turnkey/GetImage?img=9!10-SomeImage-application%2Fpdf
The controller returns the value using application/pdf as its content type.
Set the download filename
From 2023-08-31, add a fourth section to set the filename supplied with the download:
/Turnkey/GetImage?img=<object-identity>-<attribute-name>-<content-type>-<filename>
For example, the fourth section can name a downloaded PDF after the document the user selected.
Delimiter and URL-encoding considerations
The original separator is -. A hyphen is a poor delimiter when a content type or filename also contains a hyphen. The controller also checks = as a delimiter.
URL-encode values that contain URL-reserved characters. The PDF example uses application%2Fpdf because / is encoded as %2F. Test URLs that use filenames or content types containing delimiter characters so that the controller parses the intended sections.
Use the URL from a view
Use the URL as an image source when the attribute contains image data:
<img src="/Turnkey/GetImage?img=9!10-SomeImage" alt="Object image" />
Use it as a normal link when the attribute contains a downloadable file. This pattern also works from Angular views and is appropriate for an attribute marked for delayed fetch:
<a href="/Turnkey/GetImage?img=9!10-SomeImage-application%2Fpdf">Download document</a>
The browser response depends on the requested attribute and, when supplied, the content type and filename sections of the URL.
Control access to attributes
Do not treat object identity alone as authorization. Control whether an attribute is available through this controller with the AllowMVCAccess tagged value on the attribute.
| Attribute value | Default MVC access | How to enable access |
|---|---|---|
byte[] / Blob
|
Allowed, for backward compatibility | Set AllowMVCAccess as needed to make the intended policy explicit.
|
| String / text | Not allowed | Set AllowMVCAccess to ok or okwhenauthenticated.
|
Use ok when the attribute may be returned through GetImage. Use okwhenauthenticated when the caller must be authenticated. GetImage does not evaluate access groups, so do not rely on access-group rules to protect content exposed through this route.
Use durable object links when needed
The request requires an object identity. If you need a link that remains useful for longer-lived sharing or download scenarios, see The ExternalId explained. For a download-link approach, see Using BlobDownloadLink.