diff --git a/BeWo/Core/BeWoUtils.cs b/BeWo/Core/BeWoUtils.cs
index e211ad2ae..2c75b492d 100644
--- a/BeWo/Core/BeWoUtils.cs
+++ b/BeWo/Core/BeWoUtils.cs
@@ -279,7 +279,7 @@ namespace BeWo.Core
             return navigateUri.Split('?')[0] + "?" + uriValues;
         }
 
-        private static string RefreshNavigateUriString(string navigateUri)
+        public static string RefreshNavigateUriString(string navigateUri)
         {
             if (navigateUri.Contains("tenant"))
                 navigateUri = RemoveAuthenticationInfoFromUri(navigateUri);
diff --git a/BeWo/DebugConfig.cs b/BeWo/DebugConfig.cs
index 547d40d47..2b24737d3 100644
--- a/BeWo/DebugConfig.cs
+++ b/BeWo/DebugConfig.cs
@@ -138,6 +138,9 @@ namespace BeWo
 							AutoLogin = true,
 							SelectView = UIContext.Finance,
 							SelectIndex = 7,
+							Username = "m1",
+							Password = "bewobewo",
+							Profilename = "5000000000"
 						});
 
 			return name2config;
diff --git a/BeWo/View/Detail/Accounting/InvoiceOverview.xaml b/BeWo/View/Detail/Accounting/InvoiceOverview.xaml
index 797a1ca55..38bb7346a 100644
--- a/BeWo/View/Detail/Accounting/InvoiceOverview.xaml
+++ b/BeWo/View/Detail/Accounting/InvoiceOverview.xaml
@@ -123,6 +123,19 @@
                                                 </Hyperlink>
                                             </TextBlock>
                                         </Button>
+                                        <Button
+                                            x:Name="btn_xRechnung"
+                                            Width="20"
+                                            Height="20"
+                                            Margin="1"
+                                            Padding="0"
+                                            VerticalAlignment="Center"
+                                            Click="btn_xRechnung_Click"
+                                            Content="a"
+                                            FontFamily="Webdings"
+                                            FontSize="13"
+                                            Foreground="#FFFFFF"
+                                            ToolTip="Editieren" />
                                         <Button
                                             x:Name="btn_edit"
                                             Width="20"
diff --git a/BeWo/View/Detail/Accounting/InvoiceOverview.xaml.cs b/BeWo/View/Detail/Accounting/InvoiceOverview.xaml.cs
index 89242ba9d..efc6ac4cb 100644
--- a/BeWo/View/Detail/Accounting/InvoiceOverview.xaml.cs
+++ b/BeWo/View/Detail/Accounting/InvoiceOverview.xaml.cs
@@ -635,7 +635,11 @@ namespace BeWo.View.Detail.Accounting
                 BeWoApp.ShowErrorMessage("Fehler: " + res.ResponseString);
             else
                 BeWoUtils.ShowPdfWindow(res.ResponseBytes);
-
         }
-    }
+
+		private void btn_xRechnung_Click(object sender, RoutedEventArgs e)
+		{
+
+		}
+	}
 }
\ No newline at end of file
diff --git a/BeWo/app.config b/BeWo/app.config
index 4c3bb1ff3..f59aea1c8 100644
--- a/BeWo/app.config
+++ b/BeWo/app.config
@@ -14,13 +14,13 @@
         <binding name="BeWoBasicEndpoint" closeTimeout="00:05:00" openTimeout="00:10:00" receiveTimeout="00:10:00" sendTimeout="00:10:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxBufferSize="2147483647" maxReceivedMessageSize="2147483647" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true" messageEncoding="Text">
           <readerQuotas maxDepth="32" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
           <!--<security mode="None" />-->
-          <security mode="None" />
+          <security mode="Transport" />
           <!-- mode="Transport" für https und "None" sonst-->
         </binding>
         <binding name="BeWoStreamingEndpoint" receiveTimeout="10:10:00" sendTimeout="10:01:00" maxBufferSize="65536" maxReceivedMessageSize="67108864" transferMode="StreamedRequest" useDefaultWebProxy="true" messageEncoding="Text">
           <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
           <!--<security mode="None" />-->
-          <security mode="None" />
+          <security mode="Transport" />
           <!-- mode="Transport" für https und "None" sonst-->
         </binding>
         <binding name="QueryServiceEndpoint" closeTimeout="00:10:00" openTimeout="00:10:00" receiveTimeout="00:10:00" sendTimeout="00:10:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxBufferSize="2147483647" maxReceivedMessageSize="2147483647" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true" messageEncoding="Text">
diff --git a/Data/ASPHibernateSessionManager.cs b/Data/ASPHibernateSessionManager.cs
index d41cfb348..576ce999e 100644
--- a/Data/ASPHibernateSessionManager.cs
+++ b/Data/ASPHibernateSessionManager.cs
@@ -221,6 +221,27 @@ namespace BeWo.Data
             return true;
         }
 
+        private static bool TryAuthenticateWithDownloadFile(HttpApplication context)
+        {
+            if (context.Request.FilePath.IndexOf("DownloadFile.aspx") == -1)
+                return false;
+
+            var appsettingip = System.Configuration.ConfigurationManager.AppSettings["DownloadFileIpAddress"];
+            var clientip = GetIP(true);
+
+            if (appsettingip != clientip)
+                return false;
+
+            var useroidstr = context.Request.Params["useroid"];
+
+            if (!long.TryParse(useroidstr, out long useroid))
+                return false;
+
+            SessionFacade.LoggedInUser = DAOFactory.GenericDAO.LoadByID<ApplicationUser>(useroid);
+
+            return true;
+        }
+
         private static string GetIP(bool CheckForward = false)
         {
             // https://stackoverflow.com/a/13249280
diff --git a/Host/DownloadFile.aspx.cs b/Host/DownloadFile.aspx.cs
index 6948b2473..c674dd6f2 100644
--- a/Host/DownloadFile.aspx.cs
+++ b/Host/DownloadFile.aspx.cs
@@ -18,6 +18,11 @@ namespace Host
 		{
 			try
 			{
+				if (!SessionFacade.IsUserLoggedIn())
+				{
+					throw new SecurityException("Invalid authentication");
+				}
+
 				var key = this.Request.Params["key"];
 
 				if (key != "jhkf4589141324h6543958")
diff --git a/Host/GkvAbrechnungClient.aspx.cs b/Host/GkvAbrechnungClient.aspx.cs
index 5d0efdac2..3abe86f82 100644
--- a/Host/GkvAbrechnungClient.aspx.cs
+++ b/Host/GkvAbrechnungClient.aspx.cs
@@ -1,4 +1,5 @@
-using BeWo.Data.Access;
+using BeWo.Data;
+using BeWo.Data.Access;
 using BeWo.Data.Entities;
 using BeWo.Service.ServiceImplementations;
 using BS.Shared;
@@ -32,6 +33,9 @@ namespace Host
 		{
 			try
 			{
+				if (!SessionFacade.IsUserLoggedIn()) 
+					SendErrorResponse("Anmeldung erforderlich!");
+
 				//https://app5.bewoplaner.de/Host/GkvAbrechungServer?tenant=12345
 
 				var str = new StreamReader(Request.InputStream).ReadToEnd();
diff --git a/Host/ReportView.aspx.cs b/Host/ReportView.aspx.cs
index 0df34b24f..b6571ad24 100644
--- a/Host/ReportView.aspx.cs
+++ b/Host/ReportView.aspx.cs
@@ -243,7 +243,8 @@ namespace Host
 			return reportCreator.CreateCustomerInvoiceReport(invoiceOid);
         }
 
-		private XtraReport CreateAssessmentSheetReport()
+		,
+private XtraReport CreateAssessmentSheetReport()
         {
             var customerOid = long.Parse(Request.Params["coid"]);
             var month = Int32.Parse(Request.Params["m"]);
diff --git a/Host/Web.config b/Host/Web.config
index f3945e68d..4f06ea110 100644
--- a/Host/Web.config
+++ b/Host/Web.config
@@ -245,6 +245,7 @@
     <add key="DakotaPath" value="C:\Program Files (x86)\ITSG\dakotale\dakota30.exe" />
     <add key="GkvSecretKey" value="DfDGNGn72PKfSYxSUsmRdzuBtpR9novewlmYU3gsjiFgSkaZZeylUXlbO42cWNqiKgLdMUFtWUNZT962F1raQDR7HGUzCNYsFeC" />
     <add key="App8IpAddress" value="88.198.50.220" />
+    <add key="DownloadFileIpAddress" value="88.198.50.220" />
 
     <add key="SendMailModuleSmtpServer" value="mail.ownsoft.de" />
     <add key="SendMailModuleGkvEnabled" value="true" />
diff --git a/Service/Ressources/invoicetest.json b/Service/Ressources/invoicetest.json
new file mode 100644
index 000000000..c8231dd3e
--- /dev/null
+++ b/Service/Ressources/invoicetest.json
@@ -0,0 +1 @@
+{"Invoice":{"Type":"380","Number":"BWP28418","Date":"20141002","Currency":"EUR","Notice":"Rechnung gem\u00e4\u00df Bestellung vom 01.03.2018.","Period":{"Start":"20140101","End":"20140130","Description":"Leistungszeitraum xx bis yy"},"Payment":{"Type":58,"Term":"Zahlbar innerhalb 14 Tagen netto","DueDate":"20140101"}},"Seller":{"Name":"Muster GmbH","ID":null,"TaxID":null,"VatID":"DE123456789","Street":"Musterstr. 1-3","ZipCode":"30674","City":"Frankfurt","EMail":"rechnungen@musterfirma.de","CountryCode":"DE","Contact":{"Name":"Peter Musterfrau","Department":"Buchhaltung","Phone":"+49211171717","EMail":"pm@muster.de"},"BankAccount":{"IBAN":"DE38370501980147522957","BIC":"SSKMDEMMXXX","Owner":"Muster GmbH","Reference":"z.B. Rechnungnummer","ReferenceID":"Gl\u00e4ubigerID"}},"Buyer":{"Name":"Kunde GmbH","ID":null,"Street":"Stra\u00dfe Hausnummer","ZipCode":"Plz","City":"Ort","EMail":"rechnungen@kunde.de","CountryCode":"DE","Reference":"PO-Nummer oder andere Referenz, die Kunde haben will","BankAccount":{"IBAN":"DE38370501980147522957","BIC":"SSKMDEMMXXX","Owner":"Muster GmbH","MandateID":"Mandatsreferenznummer"}},"Position":[{"Quantity":2,"QuantityType":"H87","Text":"Artikel 1","Net":200,"NetTotal":400,"Tax":19,"TaxSum":76,"TaxType":"S"},{"Quantity":4,"QuantityType":"H87","Text":"Artikel 2","Net":10,"NetTotal":40,"Tax":7,"TaxSum":2.8,"TaxType":"S"}]}
\ No newline at end of file
diff --git a/Service/Service.csproj b/Service/Service.csproj
index 3decde834..8cfb86e71 100644
--- a/Service/Service.csproj
+++ b/Service/Service.csproj
@@ -516,6 +516,7 @@
     <Compile Include="UnitOfWork\HibernateSessionBehaviorExtension.cs" />
     <Compile Include="UnitOfWork\HibernateSessionContextInitializer.cs" />
     <Compile Include="Urlaubsplanung\UrlaubsplanungsManager.cs" />
+    <Compile Include="ServiceUtils\ServiceConfigReader.cs" />
     <Compile Include="Vorlagen\VorlagenManager.cs" />
     <Compile Include="XAMLInformation\InfoViaXAMLManager.cs" />
   </ItemGroup>
@@ -554,7 +555,6 @@
     <Folder Include="AI\" />
     <Folder Include="ServiceUtils\API\" />
     <Folder Include="ServiceUtils\Generell\" />
-    <Folder Include="Utils\" />
   </ItemGroup>
   <ItemGroup>
     <None Include="..\.editorconfig">
@@ -564,6 +564,7 @@
       <SubType>Designer</SubType>
     </None>
     <None Include="packages.config" />
+    <EmbeddedResource Include="Ressources\invoicetest.json" />
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
diff --git a/Service/ServiceImplementations/AccountingServiceImp.cs b/Service/ServiceImplementations/AccountingServiceImp.cs
index 38771203d..0826abe1c 100644
--- a/Service/ServiceImplementations/AccountingServiceImp.cs
+++ b/Service/ServiceImplementations/AccountingServiceImp.cs
@@ -32,6 +32,7 @@ using BeWo.Data.Models.XRechnung;
 using BS.Shared.DataContracts.Invoicing.XRechnung;
 using BeWo.Service.ServiceUtils.XRechnung;
 using System.IO;
+using BeWo.Service.ServiceUtils;
 
 namespace BeWo.Service.ServiceImplementations
 {
@@ -754,12 +755,17 @@ namespace BeWo.Service.ServiceImplementations
 		{
 			try
 			{
-				var str = File.ReadAllText(@"C:\dev\invoicetest.json", System.Text.Encoding.UTF8);
+				var str = ServiceConfigReader.GetInvoiceTestJsonString();
+
+				//var str = File.ReadAllText(@"C:\dev\invoicetest.json", System.Text.Encoding.UTF8);
 				var xrec = JsonConvert.DeserializeObject<XRechnung>(str);
 
 				var url = "https://app5.bewoplaner.de/service/DownloadFile.aspx?key=jhkf4589141324h6543958";
 
-				var response = XRechnungSender.Send(xrec, url);
+				var ds = new DownloadServiceImp();
+				var url2 = ds.CreateTemporaryUrl(url, false);
+
+				var response = XRechnungSender.Send(xrec, url2);
 
 				return response;
 			}
diff --git a/Service/ServiceImplementations/DownloadServiceImp.cs b/Service/ServiceImplementations/DownloadServiceImp.cs
index ef2fb8470..b7003cdea 100644
--- a/Service/ServiceImplementations/DownloadServiceImp.cs
+++ b/Service/ServiceImplementations/DownloadServiceImp.cs
@@ -22,6 +22,7 @@ using Utils = BeWo.Service.Core.Utils;
 using BeWo.Service.ServiceUtils;
 using BS.Shared.Translation;
 using BeWo.Service.Reporting;
+using BS.Shared.Core;
 
 namespace BeWo.Service.ServiceImplementations
 {
@@ -902,6 +903,15 @@ namespace BeWo.Service.ServiceImplementations
             return new ExcelDownload(pHeaderCaption, pContent).CreateExcelOutputString();
         }
 
+        public string CreateTemporaryUrl(string link, bool noExpiration)
+		{
+            var token = CreateTemporaryToken(link, noExpiration);
+
+            var url = TokenUtils.CreateTemporaryUrlByToken(link, token);
+
+            return url;
+		}
+
         public string CreateTemporaryToken(string link, bool noExpiration)
         {
             string token = SecurityUtils.CreateToken(noExpiration, link);
diff --git a/Service/ServiceUtils/ServiceConfigReader.cs b/Service/ServiceUtils/ServiceConfigReader.cs
new file mode 100644
index 000000000..e86757339
--- /dev/null
+++ b/Service/ServiceUtils/ServiceConfigReader.cs
@@ -0,0 +1,31 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace BeWo.Service.ServiceUtils
+{
+	public static class ServiceConfigReader
+	{
+        /// <summary>
+        /// https://stackoverflow.com/a/3314213
+        /// </summary>
+        /// <param name="name"></param>
+        /// <returns></returns>
+        public static string GetInvoiceTestJsonString()
+        {
+            var assembly = Assembly.GetExecutingAssembly();
+            var resourceName = assembly.GetManifestResourceNames()
+                            .Single(str => str.EndsWith("invoicetest.json"));
+
+            using (Stream stream = assembly.GetManifestResourceStream(resourceName))
+            using (StreamReader reader = new StreamReader(stream))
+            {
+                return reader.ReadToEnd();
+            }
+        }
+    }
+}
diff --git a/Shared/Core/TokenUtils.cs b/Shared/Core/TokenUtils.cs
new file mode 100644
index 000000000..637afd753
--- /dev/null
+++ b/Shared/Core/TokenUtils.cs
@@ -0,0 +1,34 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+
+namespace BS.Shared.Core
+{
+	public static class TokenUtils
+	{
+        public static string CreateTemporaryUrlByToken(string link, string token)
+        {
+            if (link.Contains("tenant"))
+                link = RemoveAuthenticationInfoFromUri(link);
+
+            var addChar = link.Contains("?") ? "&" : "?";
+
+            var finalUri = string.Format("{0}{1}token={2}", link, addChar, token);
+
+            return finalUri;
+        }
+
+        public static string RemoveAuthenticationInfoFromUri(string navigateUri)
+        {
+            var regex = new Regex(@"[\&|\?]?token\=[A-Za-z0-9]+|[\&|\?]?tenant\=[A-Za-z0-9]+|[\&|\?]?username\=[A-Za-z0-9.]+");
+            var splittedUri = regex.Split(navigateUri.Split('?')[1]);
+            var cleanedSplittedUri = splittedUri.Where(t => !string.IsNullOrWhiteSpace(t)).ToArray();
+            var uriValues = cleanedSplittedUri.Aggregate(string.Empty, (current, item) => current + item);
+
+            return navigateUri.Split('?')[0] + "?" + uriValues;
+        }
+    }
+}
diff --git a/Shared/DataContracts/InvoiceBaseDC.cs b/Shared/DataContracts/InvoiceBaseDC.cs
index ef00aa5b9..3fb669826 100644
--- a/Shared/DataContracts/InvoiceBaseDC.cs
+++ b/Shared/DataContracts/InvoiceBaseDC.cs
@@ -45,15 +45,6 @@ namespace BS.Shared.DataContracts
 		[DataMember] public string Hinweise { get; set; }
 		[DataMember] public string InvoiceId { get; set; }
 		[DataMember] public string InvoiceTypeText { get; set; }
-		public string PeriodString
-		{
-			get
-			{
-				return this.AccountingPeriodStart.Value.ToShortDateString() + " - "
-					   + this.AccountingPeriodEnd.Value.ToShortDateString();
-			}
-		}
-
 		[DataMember] public long? RecipientAddressOid { get; set; }
 		[DataMember] public long? RecipientAddressVersion { get; set; }
 		[DataMember] public long? RecipientCostBearerOid { get; set; }
@@ -123,6 +114,16 @@ namespace BS.Shared.DataContracts
 			}
 		}
 
+
+		public string PeriodString
+		{
+			get
+			{
+				return this.AccountingPeriodStart.Value.ToShortDateString() + " - "
+					   + this.AccountingPeriodEnd.Value.ToShortDateString();
+			}
+		}
+
 		public bool ContainsRecipientAddressData()
 		{
 			return !Utils.AreAllNullOrEmpty(this.RecipientStreet, this.RecipientPostCode, this.RecipientTown);
diff --git a/Shared/Shared.csproj b/Shared/Shared.csproj
index 2d4e7196a..bde221bbc 100644
--- a/Shared/Shared.csproj
+++ b/Shared/Shared.csproj
@@ -143,6 +143,7 @@
     <Compile Include="Core\ComplexWohnheimbuchungsRelationHelper.cs" />
     <Compile Include="Core\AbstractIDSpecificDefaultClass.cs" />
     <Compile Include="Core\MailUtils.cs" />
+    <Compile Include="Core\TokenUtils.cs" />
     <Compile Include="Core\Validator.cs" />
     <Compile Include="Core\DebugUtils.cs" />
     <Compile Include="Core\ImageUtils.cs" />