diff --git a/src/controllers/05-payment-controller.ts b/src/controllers/05-payment-controller.ts
index 63d7bd7..622ce10 100644
--- a/src/controllers/05-payment-controller.ts
+++ b/src/controllers/05-payment-controller.ts
@@ -231,7 +231,6 @@ export class PaymentFileController extends Controller {
   }
 
   @Get("{name}")
-  @Security("keycloak")
   async getAttachment(
     @Request() req: RequestWithUser,
     @Path() paymentId: string,
diff --git a/src/controllers/05-quotation-controller.ts b/src/controllers/05-quotation-controller.ts
index 052a558..c3e2d26 100644
--- a/src/controllers/05-quotation-controller.ts
+++ b/src/controllers/05-quotation-controller.ts
@@ -842,13 +842,14 @@ export class QuotationFileController extends Controller {
   }
 
   @Get("{name}")
+  @Security("keycloak")
   async getAttachment(
     @Request() req: RequestWithUser,
     @Path() quotationId: string,
     @Path() name: string,
   ) {
     await this.checkPermission(req.user, quotationId);
-    return req.res?.redirect(await getFile(fileLocation.quotation.attachment(quotationId, name)));
+    return await getFile(fileLocation.quotation.attachment(quotationId, name));
   }
 
   @Put("{name}")