diff --git a/app/Controllers/EmployeeRestController.php b/app/Controllers/EmployeeRestController.php
index 2535740..2cd2e05 100755
--- a/app/Controllers/EmployeeRestController.php
+++ b/app/Controllers/EmployeeRestController.php
@@ -986,13 +986,20 @@ class EmployeeRestController extends AdminController
             $policyName = $empData[0]['policy_name'] ?? 'Employee';
             $filename = preg_replace('/[^A-Za-z0-9_\-]/', '_', $policyName) . '-Employee-List.xlsx';
 
-            header('Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
-            header('Content-Disposition: attachment;filename="' . $filename . '"');
-            header('Cache-Control: max-age=0');
-
+            // Write to memory and return via CI Response so CORS after() filters still run.
+            // Raw header() + exit skips filters and causes CORS errors for cross-origin fetch.
+            $tempFile = tempnam(sys_get_temp_dir(), 'emp_list_');
             $writer = new Xlsx($spreadsheet);
-            $writer->save('php://output');
-            exit;
+            $writer->save($tempFile);
+            $excelData = file_get_contents($tempFile);
+            @unlink($tempFile);
+
+            return $this->response
+                ->setStatusCode(200)
+                ->setHeader('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet')
+                ->setHeader('Content-Disposition', 'attachment;filename="' . $filename . '"')
+                ->setHeader('Cache-Control', 'max-age=0')
+                ->setBody($excelData);
         } catch (\Exception $e) {
             return $this->respond(['status' => 'failed', 'code' => 500, 'data' => $e->getMessage()], 500);
         }
@@ -2406,28 +2413,62 @@ class EmployeeRestController extends AdminController
             $pre_branch_id = $this->request->getGet('pre_branch_id');
             $post_client_id = $this->request->getGet('post_client_id');
             $post_branch_id = $this->request->getGet('post_branch_id');
-            
+
+            // Both pre and post: prefer post data; fall back to pre logo if post has none
+            if (!empty($pre_client_id) && !empty($post_client_id)) {
+                $restAuthController = new RestAuthenticationController;
+                $queryParams = [
+                    'client_id' => $post_client_id,
+                    'client_branch_id' => $post_branch_id
+                ];
+                $postResponse = $restAuthController->callThirdPartyGETAPI($queryParams, 'getClientDetails');
+                $postData = is_string($postResponse) ? json_decode($postResponse, true) : null;
+
+                if (
+                    is_array($postData)
+                    && (($postData['status'] ?? '') === 'success' || (int) ($postData['code'] ?? 0) === 200)
+                    && !empty($postData['data']['client'])
+                ) {
+                    $postLogo = $postData['data']['client']['client_logo'] ?? '';
+                    if (empty($postLogo)) {
+                        if (is_string($pre_client_id) && preg_match('/^[a-f0-9]{32}$/i', $pre_client_id)) {
+                            $preClient = $this->clientModel->where('MD5(id)', $pre_client_id)->first();
+                        } else {
+                            $preClient = $this->clientModel->where('id', $pre_client_id)->first();
+                        }
+
+                        $logoFilename = $preClient['client_logo'] ?? '';
+                        $logoPath = ROOTPATH . 'public/uploads/logo/' . $logoFilename;
+                        if (!empty($logoFilename) && file_exists($logoPath)) {
+                            $postData['data']['client']['client_logo'] = base_url() . 'public/uploads/logo/' . $logoFilename;
+                        }
+                    }
+
+                    return $this->respond($postData, 200);
+                }
+
+                return $this->respond(['status' => 'failed', 'code' => 404, 'data' => []], 200);
+            }
 
             if (!empty($pre_client_id)) {
-                
                 if (is_string($pre_client_id) && preg_match('/^[a-f0-9]{32}$/i', $pre_client_id)) {
                     $client = $this->clientModel->where('MD5(id)', $pre_client_id)->first();
-                }else{
+                } else {
                     $client = $this->clientModel->where('id', $pre_client_id)->first();
-                } 
+                }
 
                 if ($client) {
-                   
-
-                    $client['client_logo'] = base_url() . 'public/uploads/logo/' . $client['client_logo'];
+                    $logoFilename = $client['client_logo'] ?? '';
+                    $logoPath = ROOTPATH . 'public/uploads/logo/' . $logoFilename;
+                    $client['client_logo'] = (!empty($logoFilename) && file_exists($logoPath))
+                        ? base_url() . 'public/uploads/logo/' . $logoFilename
+                        : '';
 
                     $clientPolicy = $this->clientPolicyModel
                         ->where('client_id', $client['id'] ?? null)
                         ->where('client_branch_id', $pre_branch_id)
                         ->findAll();
 
-                  
-
                     return $this->respond([
                         'status' => 'success',
                         'code' => 200,
@@ -2436,27 +2477,22 @@ class EmployeeRestController extends AdminController
                             'client_policy' => $clientPolicy
                         ]
                     ], 200);
-                } else {
-                   
-                    return $this->respond(['status' => 'failed', 'code' => 404, 'data' => []], 200);
                 }
-            } elseif (!empty($post_client_id)) {
-                
-                $restAuthController = new RestAuthenticationController;
 
+                return $this->respond(['status' => 'failed', 'code' => 404, 'data' => []], 200);
+            }
+
+            if (!empty($post_client_id)) {
+                $restAuthController = new RestAuthenticationController;
                 $queryParams = [
                     'client_id' => $post_client_id,
                     'client_branch_id' => $post_branch_id
                 ];
                 return $restAuthController->callThirdPartyGETAPI($queryParams, 'getClientDetails');
-
-            } else {
-               
-                return $this->respond(['status' => 'failed', 'code' => 404, 'data' => []], 200);
             }
-            
+
+            return $this->respond(['status' => 'failed', 'code' => 404, 'data' => []], 200);
         } catch (\Exception $e) {
-           
             return $this->respond(['status' => 'failed', 'code' => 500, 'data' => $e->getMessage()], 500);
         }
     }