3 ms·

Yeah, isn't "Content-Disposition: attachment;" header exactly for this?

• jsingleton 14y ago
  Content-Disposition can be very useful but it does have some potential security implications: http://www.gnucitizen.org/blog/content-disposition-hacking/ http://www.gnucitizen.org/blog/content-disposition-hacking/
  • Xylakant 14y ago
    The security implication in this case is not directly related to content-disposition. It could just as well be implemented using the download attribute. The gist of the attack is that it was possible to inject arbitrary javascript into an html file that was downloaded. After opening the file locally, the usual browser protections do not apply since it's a local file and the javascript can use this to escalate its privileges.
• porges 14y ago
  This way lets you do it for files hosted somewhere you don't have control of.