Html Header: Open file instead of download it

Question

I have this code in one asp page

Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
    Response.AppendHeader("content-disposition", "attachment; filename=PublicKeyCertificate.cer")
    Response.ContentType = "application/x-x509-ca-cert"
    Response.BinaryWrite(Session("cerbytes"))
    Response.End()
End Sub

This code download a .cer file. Instead of download it, is there any way to open it? When you set content-type to application/pdf, most browsers, open the pdf in a new tab. Can i do the same with cer files?

a pdf is opened in a new tab ONLY if the user has a PDF plugin (like Adobe reader, Foxit etc..). Can you imagine the security risk you are asking about? think about browsing to a website that downloads a file to your computer and automatically run it. would you be happy with that? — Rafael Herscovici, Oct 15 '14 at 07:47
@Dementic Thanks for the response. I knew that. However Windows can open cer files by default, no extra plugin is needed, and the file is downloaded and not opened. So the behaviour should be the same, open the file in a new tab. — Rumpelstinsk, Oct 15 '14 at 07:49

score 1 · Accepted Answer · edited Oct 07 '21 at 06:01

You have:

Response.AppendHeader("content-disposition", "attachment; filename=PublicKeyCertificate.cer")

From the spec:

If the disposition type matches "attachment" (case-insensitively), this indicates that the recipient should prompt the user to save the response locally, rather than process it normally (as per its media type).

On the other hand, if it matches "inline" (case-insensitively), this implies default processing. Therefore, the disposition type "inline" is only useful when it is augmented with additional parameters, such as the filename (see below).

You need to set the the content disposition to inline not attachment.

The browser will then handle it using its native handling. In many cases this will open it in the appropriate preference window (for browsers with internal certificate handling) or the system tool for managing certs (for browsers which hook into the OS for certificate handling).

Html Header: Open file instead of download it

1 Answers1