Thanks for your reply, i'm not aware that's a bug, maybe something changed in the authentication!! I've tryed the visibility flag, however, it doesn't allow me to send the parameter throw POST! What i need is to send everything in POST, something like "http://localhost:8080/jasperserver/flow.html", PostData="_flowId= viewReportFlow&reportUnit=/relatorios/funcionarios& output=pdf&query=select * from funcionarios&j_acegi_security_check?j_username= jasperadmin&password=password" soo that the user only see http://localhost:8080/jasperserver/flow.html Best Regards Joel Martins