Download instead of open

[mitx]

Hey guys.

Does anyone know of how I can make my server "download" files when a user clicks a certain file type eg: .mp4 on my site. Right now it tries to open in the browser for my users.

Thanks for reading.

[jason]

You need to send along a Content-disposition header to specify the content as an "attachment" (the default, when the header isn't sent, is "inline").

Content-disposition: attachment;filename=whatever.mp4

You should be able to do an .htaccess directive to set all files with certain extensions to force the Content-dispositon header with something like this:

<FilesMatch "\.(mp4|mp4|pdf)$">
    Header set Content-disposition attachment
</FilesMatch>

This should work on most browsers, though some will sometimes try and be smart and still attempt to open the file despite the header. If you still have problems after adding the new header, you may need to set the MIME type to "application/octet-stream" which essentially means "generic binary data." Since this is a generic type that could potenitally be anything the browser should always do a save instead of an open when using this MIME type. The receiving OS should still be able to handle the file based on its extension.

<FilesMatch "\.(mp4|mp4|pdf)$">
    ForceType application/octet-stream
    Header set Content-disposition attachment
</FilesMatch>

All of this is untested, so YMMV. Good luck.

--Jason

[mitx]

thanks for all the good ideas. I put mime.types application/zip because i know zip always downloads. Is that a bad idea?

[Gwaihir]

IMHO it's better to go for the generic octet-stream, rather then mislabel something as a zip when it isn't really a zip. I'd avoid such a hack as long as there are alternatives. It might be harmless, but it could also cause browsers to pass your file on to the installed unzipper who then has no clue how to unzip your pdf/mp3/whatever.

[jason]

I agree with Gwaihir. I've seen many systems that automatically run a program like WinZIP as soon as they download a zip file. While this may not be the smartest move from a security standpoint it is something that happens frequently. On those systems your file will be passed on to the associated program, which will attempt to open the file and see that it isn't properly formatted and then throw a "corrupt zip file" or similar error.

application/octet-stream was designed to be the generic "I don't know what this is, so just save it" MIME type. It is your best bet whenever you want to force saving.

--Jason

[mitx]

I agree with Gwaihir. I've seen many systems that automatically run a program like WinZIP as soon as they download a zip file. While this may not be the smartest move from a security standpoint it is something that happens frequently. On those systems your file will be passed on to the associated program, which will attempt to open the file and see that it isn't properly formatted and then throw a "corrupt zip file" or similar error.

application/octet-stream was designed to be the generic "I don't know what this is, so just save it" MIME type. It is your best bet whenever you want to force saving.

--Jason

thank you guys, this was very helpful