X-Download-Options
Downloaded files opened directly in the browser can execute scripts with access to the hosting site's security context. The X-Download-Options unofficial response header prevents this by removing the "Open" option from the download dialog.
Usage
Some browsers present the user with "Open", "Save", and "Cancel" options when downloading a file from a web application. Selecting "Open" runs the file directly within the browser, giving the downloaded content access to the site's security context. A downloaded HTML file opened this way executes scripts with access to the originating domain's Cookies and Session data, bypassing the Same Origin Policy.
The X-Download-Options header removes the "Open" option from the download dialog, leaving only "Save" and "Cancel". This forces the user to save the file to disk before opening, which runs the content in a local context instead of the domain context. The header was originally introduced in Internet Explorer 8 as a defense against HTML injection attacks where a malicious file uploaded to a trusted domain executes scripts under the domain's privileges.
Directives
noopen
The noopen directive is the only valid value for this
header. When present, the browser suppresses the "Open"
option in the download dialog, requiring users to save
downloaded files before opening them.
Example
The noopen value removes the "Open" button from the
download dialog. Without this header, a user clicking
"Open" on a downloaded HTML file runs the file within
the browser using the security context of the
originating site. With noopen, the user is required
to save the file to disk first, which runs the file in
a local context with no access to the originating
domain's cookies or session data.
X-Download-Options: noopen
This header is commonly paired with other security headers in a response. Together, they form a layered defense against content injection and cross-site attacks.
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN