1

By several REST clients the credentials are sent with every request through custom HTTP authorization headers to the REST service. Is there a way to force file download in the browser when accessing files stored in the REST service, is protected with this kind of authentication?

Force file download: Content-Disposition: attachment.
Force file download in browser: document.location.href="{downloadURL}".
There is no way to force file download with XHR.
REST requests must be stateless (according to the statelessness constraint of REST), so the session must be maintained by the REST client, and that's why I have to send credentials with every request.

Community
  • 1
inf3rno
  • 487
  • 1
  • 7
  • 19
  • Patently these headers are not providing the protection you are looking for. It might be helpful if you explained what the threat you are trying to protect against is. – symcbean Jun 02 '14 at 16:14

1 Answers1

3

With a recent browser, you can use client-side JavaScript to prompt the user to save an arbitrary blob (including one you just downloaded from the server using XmlHttpRequest 2). You can even specify a filename.

See: https://github.com/eligrey/FileSaver.js

One caveat is that I believe the data will have to be cached in memory, rather than written to disk incrementally as it is downloaded, as would be done with a normal file download, which may be a problem for a large file.

jbms
  • 466
  • 2
  • 3