>I know I can use Crystal Reports to create a .pdf file on the web server and then provide a URL to the user to download the file, but is there a way to skip creating the .pdf file? I don't want to have to worry about security and having users be able to download other users' documents.

Not tested, but should be possible. Use the XMLHTTP object to send the request for the PDF file to be generated. On the Server end, when the request is received, generate the PDF (as temporary file), send it back to the client as a response with Response.BinaryWrite method. Once sent, delete the server-side version. On the client-side the PDF is received in the .PDF with the .ResponseBody property (http://msdn.microsoft.com/en-us/library/ms535874(VS.85).aspx). Once received, it can be saved, displayed, or what-ever. There several examples on the web: Google XMLhttp Object.