Imagine a server that serves untrustes user-provided files and allows other users to download them. Under some circumstances server can be tricked to return responses to download file requests without Content-Disposition header (i.e. files are shown in browser's window inlined)

However, other measures of security hygiene are still in place:

• Files are served at another domain than the main site's content
• Correct Content-Type and X-Content-Type-Options:nosniff exist

What are security risks of returning responses without Content-Disposition header?

Imagine a server that serves untrusted user-provided files and allows other users to download them. Under some circumstances server can be tricked to return responses to download file requests without Content-Disposition header (i.e. files are shown in browser's window inlined)

However, other measures of security hygiene are still in place:

• Files are served at another domain than the main site's content
• Correct Content-Type and X-Content-Type-Options:nosniff exist

What are security risks of returning responses without Content-Disposition header?