diff --git a/pages/api/file/downloadblob.js b/pages/api/file/downloadblob.js
index 3973d93a..5209128e 100644
--- a/pages/api/file/downloadblob.js
+++ b/pages/api/file/downloadblob.js
@@ -32,15 +32,39 @@ ApiProxy.get(async (req, res) => {
         });
     }
 
-    const checkquerypath =
+    const blobNameTrimmed = blobName.trim();
+    const hashCandidatePaths = [
         "/api/file/downloadblob?container=" +
-        containerName +
-        "&casefolderID=" +
-        casefolderID +
-        "&blobname=" +
-        blobName.trim();
+            containerName +
+            "&casefolderID=" +
+            casefolderID +
+            "&blobname=" +
+            blobNameTrimmed,
+        "/api/file/downloadblob?container=" +
+            containerName +
+            "&casefolderID=" +
+            encodeURIComponent(casefolderID) +
+            "&blobname=" +
+            blobNameTrimmed,
+        "/api/file/downloadblob?container=" +
+            containerName +
+            "&casefolderID=" +
+            casefolderID +
+            "&blobname=" +
+            encodeURIComponent(blobNameTrimmed),
+        "/api/file/downloadblob?container=" +
+            containerName +
+            "&casefolderID=" +
+            encodeURIComponent(casefolderID) +
+            "&blobname=" +
+            encodeURIComponent(blobNameTrimmed)
+    ];
 
-    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+    const isHashValid = hashCandidatePaths.some(
+        (candidatePath) => hashAPIPath(candidatePath) == "&hash=" + checkHash
+    );
+
+    if (!isHashValid) {
         return respondError(res, {
             status: 400,
             code: "INVALID_HASH",