The W3 validator points out that you need to escape those ampersands. We mostly get away not escaping them, but who knows, maybe that's the issue. So:
http://192.168.200.32:9999/USER_STORAGE?user=bt&token=bEVfjg%2FGHoHHU2CxmAWyiTXFUgN9kN2o8pEKgCFV5Fw%3D&nonce=9jJgj4qGXB4U7m%2FJXjjsmbfreH2J2nT8D789jHY6zro%3D&parent_session=cjDEN3PvltsAqjiagynS8mN6HKeAgqWv82WJqxWiXD8%3D&method=download&filename=Testdokument2
..although I tested those params unescaped and they worked fine on IE7, IE8, Chrome4, Safari4, and Firefox3.6 on Windows. (See test page below)
If that's not it:
- Are you testing it by navigating to that point in the desired browser, rather than copy-and-paste? (E.g., does the session mechanism rely on a cookie, or disregard attempts from a different user agent, or...?)
- If there are cookies involved, does this link use a different port from the response that set the cookie?
My unescaped test page, worked as expected despite being invalid:
<!DOCTYPE HTML>
<html>
<head>
<meta http-equiv="Content-type" content="text/html;charset=UTF-8">
<title>Test Page</title>
<style type='text/css'>
body {
font-family: sans-serif;
}
</style>
</head>
<body><div>
<a href='showparams.jsp?user=bt&token=bEVfjg%2FGHoHHU2CxmAWyiTXFUgN9kN2o8pEKgCFV5Fw%3D&nonce=9jJgj4qGXB4U7m%2FJXjjsmbfreH2J2nT8D789jHY6zro%3D&parent_session=cjDEN3PvltsAqjiagynS8mN6HKeAgqWv82WJqxWiXD8%3D&method=download&filename=Testdokument2' target='_blank'>the link</a>
</div></body>
</html>
Escaped test page, also worked as expected:
<!DOCTYPE HTML>
<html>
<head>
<meta http-equiv="Content-type" content="text/html;charset=UTF-8">
<title>Test Page</title>
<style type='text/css'>
body {
font-family: sans-serif;
}
</style>
</head>
<body><div>
<a href='showparams.jsp?user=bt&token=bEVfjg%2FGHoHHU2CxmAWyiTXFUgN9kN2o8pEKgCFV5Fw%3D&nonce=9jJgj4qGXB4U7m%2FJXjjsmbfreH2J2nT8D789jHY6zro%3D&parent_session=cjDEN3PvltsAqjiagynS8mN6HKeAgqWv82WJqxWiXD8%3D&method=download&filename=Testdokument2' target='_blank'>the link</a>
</div></body>
</html>