Suppose our site allows uploading any HTML files.

Then a hacker can steal other's cookie using JavaScript.

What if we will serve uploaded HTML files with Content-Disposition: attachment? Will this protect against this kind of attack?

What are other variants of protection? We may serve uploaded files from another domain. Are there other way to protect ourselves against this?

2 Answers 2


According to the standards, if you use Content-Disposition: attachment, it is expected that the browser will not display the HTML file but instead prompt the user to save it as a file.

If you just want to share HTML files without displaying them, I suppose that's fine, though the conventional thing to do would be to put them in an archive format, such as .tar.gz or .zip.


If you place the uploaded files in a specific location on the server, configure your webserver to display them as text so that they will never execute.

  • it is not what we need
    – porton
    Dec 4, 2016 at 22:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .