Quoting from McAfee MVISION CASB

Many cloud services use custom content disposition headers in an effort to improve the performance of their applications. These custom headers have the unintended side effect of preventing network security solutions (and on-premises DLP solutions that integrate to them via ICAP) from inspecting content for DLP.

What are the content disposition headers exactly and why they prevent network solution from inspecting content?

As per Microsoft Content-disposition is an extension to the MIME protocol that instructs a MIME user agent on how it should display an attached file

1 Answer 1


This is honestly bizarre and a number of searches find me no references aside from this article to say that content disposition headers are in any way involved with performance.

The content disposition header effectively tells the user agent (browser) how to handle or display the file if it is requested directly. The primary usage of it in HTTP responses is to specify that a file is to be downloaded rather than displayed inline.

The valid syntax for the response headers are as follows:

Content-Disposition: inline
Content-Disposition: attachment
Content-Disposition: attachment; filename="some.file"

The first is the default, meaning the content is displayed in the user agent as normal.

The second indicates that the content must be processed as an attachment, which in the context of a browser means a file to be downloaded and not displayed inline. The default name of the file is the final part of the URI's path. For example, in the URL https://foo.bar/downloads/fuzz.xyz, the file name would default to fuzz.xyz.

The third option is the same as before, except the default filename is explicitly specified.

Additionally, the content disposition header can be used as part of a multipart HTTP request, most commonly in order to enable file uploads:

Content-Disposition: form-data
Content-Disposition: form-data; name="fieldName"
Content-Disposition: form-data; name="fieldName"; filename="filename.jpg"

As far as I know, there are no performance reasons to use this, or use any non-standards compliant variant of it. I couldn't find any reference to anyone doing so either.

My guess is that some cloud platforms utilise the Content-Disposition header in some non-standard ways (e.g. using it to perform programmatic file uploads as part of a REST API) which is incompatible with DLP solutions that naively rely upon the file extension in the indicated filename, leading it to assume that the data being transferred was of filetype X, when it was of a different (or no) filetype, resulting in incorrect parsing of the data.

On a personal note, I wouldn't trust any information you find in marketing materials written by DLP vendors. I've tested a number of products and not a single one was able to correctly identify policy-violating data exfiltration even when being obscenely loud about it (e.g. putting fake customer data directly onto Pastebin). They make a lot of claims and very rarely come close to backing them up.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .