web security: What happens when Content-Disposition is not supplied?

0
votes

I am allowing users to download files from my application. For that I am explicitly setting "Content-Disposition" as "inline" or "attachment" based on the type of file. This is kinda manual right now. So, for pdf files i set it to "inline" but for html files I set it to "attachment".

  1. Is there a way to automatically decide the value of "Content-Disposition" in express based on file type ?

  2. If I do not send a "Content-Disposition" header, it seems to me currently that the request is treated like it has "Content-Disposition: inline" . Is this observation correct, or is there something more to it?

  3. If by default browser tries to execute/preview the files (based on point 2), what does it mean for security when you allow downloading html files which can execute javascript?

1
javascriptexpresssecuritydownloadcontent-disposition

1 Answers

1
votes

Is there a way to automatically decide the value of "Content-Disposition" in express based on file type ?

You could write middleware that inspects the response and modifies it.

If I do not send a "Content-Disposition" header, it seems to me currently that the request is treated like it has "Content-Disposition: inline" . Is this observation correct, or is there something more to it?

See MDN which says: "The first parameter in the HTTP context is either inline (default value, indicating it can be displayed inside the Web page, or as the Web page)…"

If by default browser tries to execute/preview the files (based on point 2), what does it mean for security when you allow downloading html files which can execute javascript?

Not a lot unless you are serving up JavaScript that you (the website author) do not trust.

If you need to serve HTML documents which might contain JavaScript you don't trust then serve them from a different origin (to use the Same Origin Policy to sandbox them) and/or implement a Content Security Policy to ban them from executing JavaScript.