Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
So basically the href of the anchor tag is something like hxxtp://www.xxxx/xx.zip and the anchor tag text visible to user is something like xxxx.pdf ,when user clicks it Mozilla opens it as a .pdf but actually it is a .zip.
My doubt: Why is firefox opening it as a pdf when the url says it's a .zip ,does firefox read the header of the file and decide if its a pdf or a .zip ,is this not fooling a user into clicking a .zip, although he thinks that it's a pdf?
There are three seperate things at play here:
<a> text visible to the user (which can be anything and doesn't need to be a valid link)href attribute of the <a> tagBrowsers do not use file extensions to determine the type of the content being served. Instead, they inspect the Content-Type header in the HTTP response that the server sends.
It is completely possible (albeit surprising) for an HTTP server to be configured in such a way that a .zip will be served with a PDF type (application/pdf), in which case the browser will try to open it as a PDF file (whether it succeeds in doing so depends on whether the contents of the file form an actual, valid PDF). Likewise, it is completely possible for a server to serve a .pdf file as a ZIP file (application/zip), in which case the browser will try to open it as a ZIP file. The extension of the file is irrelevant; it's the Content-Type that the server reports that counts.
