4

Consider the following page:

https://8chan.co/stackoverflow.html

Why does the first link work, but the second link doesn't? Do I need to send a certain header, or is it impossible to use the download attribute on a subdomain?

Fredrick Brennan
  • 7,079
  • 2
  • 30
  • 61

1 Answers1

3

Chrome actually does allow the download attribute on cross-origin files, without CORS headers, but Firefox chose not to, citing potential social-engineering attacks.

Check this link... HTML5 download attribute not working when downloading from another server, even when Access-Control-Allow-Origin is set to all (*)

You could fix it with php proxy file something like:

<?php
$url = $_GET['file'];
$name = $_GET['name'];
header("Content-type: application/$ext");
header("Content-Disposition: attachment; filename=".$name);
echo readfile($url);
?>
Community
  • 1
  • 1
SergioZgz
  • 148
  • 5
  • I know this was posted a while ago, but the mp4 file is corrupt when I use the above code...? – FluxCoder Sep 25 '16 at 17:45
  • better not add trailing `?>` as it may corrupt the output – thybzi Oct 10 '16 at 11:51
  • and what is `$ext`? that should be for file extension, but the variable isn't defined – thybzi Oct 10 '16 at 11:54
  • "Chrome actually does allow the download attribute on cross-origin files" — I suppose at the moment Chrome also disables cross-origin download attr – thybzi Oct 10 '16 at 11:56
  • 1
    This code allows header injection and serves a proxy for any file on the internet. **That should be considered unsafe.** Don't build something like this without a whitelist! – Franz May 06 '19 at 11:34