We need to allow head request to our /exports and /diffs endpoint, this should be a proxy to s3 HEAD api, this will allow users to know the file size and other data before they start the download.
Don't forget to allow HEAD requests on IaC in firewall and policy.csv (casbin).