Installing an upgraded osgi org.apache.sling.security-1.1.16.jar corrects this issue (presumably adding the right headers into the response if @fernandou23761826 's analysis of the problem is correct).@ kautuksahni​ is this the official solution? how will this get rolled out, do i need to include sling security jar as a provided dependency along with custom code?

Thanks a lot. Saved my day.

Thanks, awesome. Very helpful suggestion.

Thanks for your mail. The below two lines are not giving me node name. In jsp it works, but not in sightly. Can you please share a sample code which has node conversion, page conversion etc.node = currentPage.getContentResource().adaptTo(Node.class); title = node.getName();

I was also having a similar use-case where I have to zip a few files under DAM assets so I was looking some online OOTB/Blog and I found link https://helpx.adobe.com/experience-manager/using/downloading-dam-assets.html. Thought to update it here.