see
Send Files to Browser Clients the Right Way
http://www.fawcette.com/javapro/2002_03/online/online_eprods/servlets_03_08/default_pf.asp
// fetch the file
String filename = "companySecret.txt";
String filepath = "C:\\";
response.setContentType(
"APPLICATION/OCTET-STREAM");
response.setHeader("Content-Disposition",
"attachment; filename=\""
     + filename + "\""); java.io.FileInputStream fileInputStream =
new java.io.FileInputStream(filepath
     + filename);
int i;
while ((i=fileInputStream.read()) != -1) {
out.write(i);
}
fileInputStream.close();
out.close();