As for th PDFs, it would be probably be better if you sent back in your
XML URLs for the PDF files that you are creating (on the fly I'm
guessing) so the client can simply make another request to the server
and have them served up. No need for you to "send" them in your
response unless you want to put them inside of your XML data.
The PDFs are created as part of the monthly bill generation. They're in
the IFS ready to pass to the client. Are you suggesting that the
customer's browser would then access the pdf on the IFS through a URL? If
so, are there risks that the browser could then access other files?