Do I need to explore security measures for the native HTML <a download> feature? What are some ways that this feature opens my website up to potential threats, and how should I mitigate those threats? Or (fingers crossed) have I nothing to worry about here?

  • This question is missing essential context: who provides this tag and its attributes and who provides the file to download. If any of this is provided by a potentiell attacker then misuse might be possible, for example by giving a different file name in the HTML tag than the actual file name served and thus bypassing some content inspection. – Steffen Ullrich May 27 '19 at 4:56
  • The file is static on the server, and the attribute is coded in to the page by us. I'm wondering (maybe unnecessarily) if the action of downloading the file, thus opening a link from the server to the user's machine, is cause for any proactive security measures, or is it not possible to backwards engineer this function in any way. – Claire May 27 '19 at 5:04
  • 1
    Such downloads can happen even without the download attribute, i.e. every content type which can not be handled inline by the browser is downloaded. What type of file is it, what Content-Type is used to deliver the file and what file name is set either in the download attribute or in the Content-Disposition header (if any file name is set at all)? – Steffen Ullrich May 27 '19 at 5:23
  • 1
    thus opening a link from the server to the user's machine. This is done when the user connects to the webserver to get the web page. You should of course keep a public facing service up to date, but there's no difference between getting a webpage and getting a file to store on disk. Both behave exactly the same from the servers viewpoint! – vidarlo May 27 '19 at 5:35
  • 1
    in short: there's nothing extra to worry about. – dandavis May 27 '19 at 6:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.