My application when downloading XML file returns headers:

Content-Type: Application/Octed-Stream
Content-Disposition: attachment; filename=file.xml

Is this behavior correct form security point of view or it should be specified that this is XML file?


that MIME ("Application/Octet-Stream"), used with the Content-Disposition header, simply makes sure that browsers download the url instead of displaying it in the browser. There should not be any security implications of such a configuration. If you want to be able to view the URL online in the browser you can change it's type to "text/xml" or "application/xml".

  • The correct header to instruct browsers to download the content is Content-Disposition: attachment and not Content-type. There are browser quirks which would also interpret application/octet-stream as text/html, notably IE. I'd suggest using correct Content-type header along with Content-disposition. And, not to forget X-Content-Type-Options: nosniff, just in case. – 1lastBr3ath Jan 7 '18 at 3:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.